Pbaps u2 Ts Bases

PBAPS UNIT 2- LICENSE NO. DPR-44TECHNICAL SPECIFICATIONS BASES

PAGE REVISION LISTING

B TABLE OF CONTENTS

page(s) i ...................................................................................................................... Rev 25

B 2.0 SAFETY LIMITS (SLs)

page(s) 2.0-1 ................................................. Rev 472.0-3 .............................................................................................................. Rev 472.0-4 .............................................................................................................. Rev 472.0-5 .............................................................................................................. Rev 572.0-6 .............................................................................................................. Rev 572.0-8 .............................................................................................................. Rev 572.0-9 .............................................................................................................. Rev 572.0-10 ............................................................................................................ Rev 57

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY

page(s) 3.0-5 ............................................................................................................. Rev 523.0-5a ................................................. I .......................................................... Rev 523.0-6 .............................................................................................................. Rev 523.0-12 .............................................................................................................. Rev 63.0-13 .............................................................................................................. Rev 13.0-14 ............................................................................................................ Rev 523.0-15 ............................................................................................................ Rev 52

B 3.1 REACTIVITY CONTROL SYSTEMS

page(s) 3.1-14 ........................................................................................................... Rev 493.1-15 - 18 (inclusive) .................................................................................. Rev 23.1-23 ........................................................................................................... Rev 493.1-23 ........................................................................................................... Rev 493.1-25 ........................................................................................................... Rev 573.1-26 ............................................................................................................. Rev 93.1-27 ........................................................................................................... Rev 573.1-28 ............................................................................................................. Rev 93.1-29 ........................................................................................................... Rev 493.1-31 - 33 (inclusive) ........................................ ................................... Rev 23.1-49 ........................................................................................................... Rev 573.1-50 ........................................................................................................... Rev 57

B 3.2 POWER DISTRIBUTION LIMITS

page(s) 3.2-1 - 5 (inclusive) ..................................................................................... Rev 493.2-7 ............................................................................................................. Rev 473.2-8 ............................................................................................................. Rev 243.2-9 ............................................................................................................. Rev 573.2-10 .......................................................................................................... Rev 473.2-11 ........................................................................................................... Rev 473.2-12 ........................................................................................................... Rev 493.2-12a ......................................................................................................... Rev 493.2-13 ........................................................................................................... Rev 47

PBAPS Unit 2 i Revision No. 60



B 3.3 INSTRUMENTATION

page(s) 3.3-5 - 6 (inclusive) ..................................................................................... Rev 243.3-7 ............................................................................................................. Rev 543.3-8 ............................................................................................................. Rev 503.3-9 ............................................................................................................. Rev 503.3-10 ........................................................................................................... Rev 363.3-11 ........................................................................................................... Rev 363.3-12 ........................................................................................................... Rev 503.3-12a ......................................................................................................... Rev 503.3-12b ......................................................................................................... Rev 503.3-18 - 19 (inclusive) ................................................................................. Rev 433.3-23 ........................................................................................................... Rev 363.3-24 ........................................................................................................... Rev 503.3-25 .......................................................................................................... Rev 503.3-26 ........................................................................................................... Rev 363.3-27 ........................................................................................................... Rev 543.3-27a ......................................................................................................... Rev 543.3-28 ........................................................................................................... Rev 363.3-29 ........................................................................................................... Rev 493.3-30 ........................................................................................................... Rev 363.3-31 ........................................................................................................... Rev 363.3-32 .......................................................................................................... Rev 503.3-33 ........................................................................................................... Rev 503.3-34 ........................................................................................................... Rev 503.3-35 ........................................................................................................... Rev 503.3-35a ......................................................................................................... Rev 543.3-35b ......................................................................................................... Rev 503.3-36 - 44 (inclusive) ................................................................................. Rev 243.3-45 - 46 (inclusive) ................................................................................. Rev 363.3-52 - 55 (inclusive) ................................................................................. Rev 363.3-57 ........................................................................................................... Rev 363.3-59 ........................................................................................................... Rev 433.3-60 ........................................................................................................... Rev 493.3-62 ........................................................................................................... Rev 573.3-67 ............................................................................................................. Rev 73.3-68 ............................................................................................................. Rev 33.3-69 ........................................................................................................... Rev 573.3-70 ........................................................................................................... Rev 553.3-71 ........................................................................................................... Rev 523.3-72 - 73 (inclusive) ................................................................................... Rev 33.3-74 ........................................................................................................... Rev 553.3-75 ........................................................................................................... Rev 553.3-78 ........................................................................................................... Rev 523.3-89 ........................................................................................................... Rev 573.3-91 h ......................................................................................................... Rev 253.3-91i ......................................................................................................... Rev 433.3-91a ......................................................................................................... Rev 253.3-91 b ......................................................................................................... Rev 493.3-91 c ......................................................................................................... Rev 493.3-91d - 91e (inclusive) ............................................................................ Rev 433.3-91f .......................................................................................................... Rev 573.3-91 g ........................................................................................................ Rev 573.3-91j ......................................................................................................... Rev 253.3-98 ........................................................................................................... Rev 213.3-99 ........................................................................................................... Rev 57

PBAPS Unit 2 ii Revision No. 60

PBAPS UNIT 2 - LICENSE NO. DPR-44TECHNICAL SPECIFICATIONS BASES


B 3.3 INSTRUMENTATION (continued)

page(s) 3.3-100 ......................................................................................................... Rev 573.3-101 ......................................................................................................... Rev 573.3-102 ......................................................................................................... Rev 573.3-103 ......................................................................................................... Rev 573.3-104 ......................................................................................................... Rev 573.3-106 ......................................................................................................... Rev 573.3-124 ......................................................................................................... Rev 583.3-125 ......................................................................................................... Rev 583.3-142 ......................................................................................................... Rev 483.3-143 ......................................................................................................... Rev 483.3-144 ......................................................................................................... Rev 573.3-145 ......................................................................................................... Rev 573.3-149 ......................................................................................................... Rev 483.3-149a ....................................................................................................... Rev 483.3-151 ............................................... Rev 203.3-155 ......................................................................................................... Rev 323.3-159 ............................................... Rev 573.3-159a ....................................................................................................... Rev 573.3-160 ......................................................................................................... Rev 573.3-161 ......................................................................................................... Rev 483.3-162 ......................................................................................................... Rev 453.3-166 ......................................................................................................... Rev 483.3-167 ......................................................................................................... Rev 203.3-168 - 186 (inclusive) ............................................................................... Rev 13.3-187 .......................................................................................................... Rev 53.3-188 - 190 (inclusive) ............................................................................ Rev 303.3-191 - 198 (inclusive) ............................................................................... Rev 53.3-199- 205 .................................................................................................. Rev 1

B 3.4 REACTOR COOLANT SYSTEM (RCS)

page(s) 3.4-3 ............................................................................................................. Rev 503.4-4 ............................................................................................................. Rev 503.4-5 ............................................................................................................. Rev 503.4-6 ............................................................................................................. Rev 503.4-7 ............................................................................................................ Rev 503.4-8 ............................................................................................................. Rev 503.4-9 ............................................................................................................. Rev 503.4-10 ........................................................................................................... Rev 503.4-18 .......................................................................................................... Rev 233.4-25 ........................................................................................................... Rev 603.4-27 .......................................................................................................... Rev 523.4-31 .......................................................................................................... Rev 523.4-35 ......................................................................................................... Rev 523.4-39 ............................................................................................................ Rev 13.4-52 .......................................................................................................... Rev 49

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR COREISOLATION COOLING (RCIC) SYSTEM

page(s) 3.5-5 ............................................................................................................. Rev 573.5-6 ............................................................................................................. Rev 573.5-10 ........................................................................................................... Rev 563.5-11 ........................................................................................................... Rev 573.5-14 - 15 (inclusive) ................................................................................... Rev 23.5-16 ........................................................................................................... Rev 233.5-17 ........................................................................................................... Rev 513.5-19 ........................................................................................................... Rev 57

PBAPS Unit 2 iii Revision No. 60



B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR COREISOLATION COOLING (RCIC) SYSTEM (continued)

page(s) 3.5-22 ........................................................................................................... Rev 573.5-23 ........................................................................................................... Rev 573.5-26 ........................................................................................................... Rev 523.5-27 ........................................................................................................... Rev 563.5-28 ........................................................................................................... Rev 42

B 3.6 CONTAINMENT SYSTEMS

page(s) 3.6-1 ............................................................................................................. Rev 273.6-2 ............................................................................................................. Rev 193.6-3 ............................................................................................................... Rev 63.6-4 - 5 (inclusive) ..................................................................................... Rev 223.6-7 ............................................................................................................. Rev 523.6-11 ............................................................................................................. Rev 63.6-12 ........................................................................................................... Rev 573.6-13 ........................................................................................................... Rev 193.6-17 - 18 (inclusive) ................................................................................... Rev 23.6-20 ........................................................................................................... Rev 573.6-21 ........................................................................................................... Rev 573.6-22 ........................................................................................................... Rev 573.6-25 ........................................................................................................... Rev 573.6-26 ........................................................................................................... Rev 573.6-27 ........................................................................................................... Rev 573.6-28 ........................................................................................................... Rev 353.6-29 ........................................................................................................... Rev 223.6-30 .......................................................................................................... Rev 573.6-31 .......................................................................................................... Rev 183.6-33 .......................................................................................................... Rev 193.6-43 ........................................................................................................... Rev 443.6-47 ........................................................................................................... Rev 443.6-49 - 51 (inclusive) ................................................................................. Rev 243.6-58 ............................................................................................................. Rev 13.6-64 - 66 (inclusive) ................................................................................. Rev 373.6-69 ........................................................................................................... Rev 373.6-76 ........................................................................................................... Rev 573.6-77 ........................................................................................................... Rev 573.6-79 ........................................................................................................... Rev 573.6-81 ........................................................................................................... Rev 573.6-82 ........................................................................................................... Rev 573.6-83 ........................................................................................................... Rev 573.6-90 ............................................................................................................. Rev 1

B 3.7 PLANT SYSTEMS

page(s) 3.7-1 ............................................................................................................. Rev 173.7-6 ............................................................................................................... Rev 43.7-7 ............................................................................................................. Rev 113.7-8 ............................................................................................................. Rev 563.7-8a ........................................................................................................... Rev 333.7-9 ............................................................................................................. Rev 563.7-12 ............................................................................................................. Rev 23.7-13 ............................................................................................................. Rev 13.7-15 ........................................................................................................... Rev 343.7-21 ........................................................................................................... Rev 203.7-26 ........................................................................................................... Rev 493.7-27 ........................................................................................................... Rev 493.7-29 ........................................................................................................... Rev 31

PBAPS Unit 2 iv Revision No. 60



B 3.8 ELECTRICAL POWER SYSTEMS

page(s) 3.8-2 - 3 (inclusive) ...................................................................................... Rev 333.8-5 ................................................................................................................ R ev 53.8-6 .............................................................................................................. R ev 523.8-7 .............. ...... .......................... .... Rev 53.8-8 ....................... Rev 53.8-9 ..................... '".Rev 383.8-10 ..................... ... ... Rev 53.8-11 ................ ... ....... Rev 603.8-12 ................................................. Rev 13.8-22 ........................................... ..... Rev 323.8-24 ................................................. Rev 13.8-25 .................................... ...... ......... Rev 13.8-26 ........... ......... Rev 573.8-27 ................... . ............... Rev 573.8-27a ........................................................................................................ R ev 57'3.8-28 ........................................... ... Rev 13.8-29 .......................................... ...... Rev 13.8-30 ................................................. Rev 13.8-31 ......... Rev 573.8-32 ....................... Rev 573.8-35 - 37 (inclusive) ................................................................................. Rev 103.8-42 ........................................................................................................... R ev 573.8-46 - 47 (inclusive) ................................................................................. Rev 163.8-55 ........................................................................................................... R ev 37

B 3.9 REFUELING OPERATIONS

page(s) 3.9-1 ............................................................................................................. R ev 293.9-3 ............................................................................................................. R ev 293.9-8 ............................................................................................................. R ev 243.9-10 ........................................................................................................... R ev 243.9-14 ........................................................................................................... R ev 243.9-15 ............................................................................................................. R ev 2

B 3.10 SPECIAL OPERATIONS

page(s) 3.10-1 ............................................................................................................. Rev 13.10-5 ........................................................................................................... R ev 243.10-31 ............................................... Rev 243.10-32 ......................................................................................................... R ev 363.10-35 ......................................................................................................... R ev 363.10-36 ........................................................................................................... R ev 2

All remaining pages are Rev 0 dated 1/18/96.

PBAPS Unit 2 V Revision No. 60

TABLE OF 'CONTENTS

B 2.0 SAFETY LIMITS (SLs) . . . . . . . . . . . . . . . . . .B 2.1.1 Reactor Core SLs ...... ..................B 2.1.2 Reactor Coolant System (RCS) Pressure SL ....

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY .B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY . . ..

B 3.1 REACTIVITY CONTROL SYSTEMS ..... ......... . ....B 3.1.1 SHUTDOWN MARGIN (SDM) ..............B 3.1.2 Reactivity Anomalies ...... ................B 3.1.3 Control Rod OPERABILITY .............B 3.1.4 Control Rod Scram Times .............B 3.1.5 Control Rod Scram Accumulators ... ...........B 3.1.6 Rod Pattern Control ............ . . .B 3.1.7 Standby Liquid Control (SLC) System .......B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves

B 3.2 POWER DISTRIBUTION LIMITS ..............B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE

(APLHGR) . . .. . . . . . .B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) .......B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) .......

B 3.3B 3.3.1.1B 3.3.1.2B 3.3.2.1B 3.3.2.2

B 3.3.3.1B 3.3.3.2B 3.3.4.1

B 3.3.4.2

B 3.3.5.1

B 3.3.5.2

B 3.3.6.1B 3.3.6.2B 3.3.7.1

B 3.3.8.1B 3.3.8.2

INSTRUMENTATION . . . . . . . . . . . . . . . . . . .Reactor Protection System (RPS) InstrumentationWide Range Neutron Monitor (WRNM) InstrumentationControl Rod Block Instrumentation ........Feedwater and Main Turbine High Water Level Trip

Instrumentation ...... .................Post Accident Monitoring (PAM) InstrumentationRemote Shutdown System ..... ...............Anticipated Transient Without Scram Recirculation

Pump Trip (ATWS-RPT) Instrumentation .....End of Cycle Recirculation Pump Trip

(EOC-RPT) Instrumentation . . . B 3.3-91a thruEmergency Core Cooling System (ECCS)

Instrumentation ...... ..................Reactor Core Isolation Cooling (RCIC) System

Instrumentation ...... .................Primary Containment Isolation InstrumentationSecondary Containment Isolation InstrumentationMain Control Room Emergency Ventilation (MCREV)

System Instrumentation ............Loss of Power (LOP) Instrumentation .......Reactor Protection System (RPS) Electric Power

Monitoring . . . . . . . . . . . . . . . . . .

B 2.0-1B 2.0-IB 2.0-7

B 3.0-1B 3.0-10

B 3.1-IB 3.1-IB 3.1-8B 3.1-13B 3.1-22B 3.1-29B 3.1-34B 3.1-39B 3.1-48

B 3.2-1

B 3.2-1B 3.2-6B 3.2-11

B 3.3-1B 3.3-1B 3.3-36B 3.3-45

B 3.3-58B 3.3-65B 3.3-76

B 3.3-83

B 3.3-91j

B 3.3-92

B 3.3-130B 3.3-141B 3.3-169

B 3.3-180

B 3.3-187

B 3.3-199

(continued)

PBAPS UNIT 2 i Revision No. 25

TABLE OF CONTENTS (continued)

B 3.4B 3.4.1B 3.4.2B 3.4.3B 3.4.4B 3.4.5B 3.4.6B 3.4.7

B 3.4.8

B 3.4.9B 3.4.10

B 3.5

B 3.5.1B 3.5.2B 3.5.3

B 3.6B 3.6.1.1B 3.6.1.2B 3.6.1.3B 3.6.1.4B 3.6.1.5

B 3.6.1.6B 3.6.2.1B 3.6.2.2B 3.6.2.3

B 3.6.2.4B 3.6.3.1B 3.6.3.2B 3.6.4.1B 3.6.4.2B 3.6.4.3

REACTOR COOLANT SYSTEM (RCS) ..... .............Recirculation Loops Operating ..........Jet Pumps . . . . . . . . . . . . . . . . . . . .Safety Relief Valves (SRVs) and Safety Valves (SVs)RCS Operational LEAKAGE .............RCS Leakage Detection Instrumentation ......RCS Specific Activity ............Residual Heat Removal (RHR) Shutdown Cooling

System-Hot Shutdown ...........Residual Heat Removal (RHR) Shutdown Cooling

System-Cold Shutdown .....................RCS Pressure and Temperature (P/T) Limits ....Reactor Steam Dome Pressure ...........

EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR COREISOLATION COOLING (RCIC) SYSTEM ...........

ECCS-Operating .................ECCS-Shutdown ........ ..................RCIC System . . . . . . . . . . . . . . . . . . .

CONTAINMENT SYSTEMS ............. ....Primary Containment ...............Primary Containment Air Lock ..... ...........Primary Containment Isolation Valves (PCIVs) .Drywell Air Temperature .............Reactor Building-to-Suppression Chamber Vacuum

Breakers . . . . . . . . . . . . . . . . . . .Suppression Chamber-to-Drywell Vacuum BreakersSuppression Pool Average Temperature ..........Suppression Pool Water Level .... ............Residual Heat Removal (RHR) Suppression Pool

Cooling ........ ... ....................Residual Heat Removal (RHR) Suppression Pool SprayContainment Atmospheric Dilution (CAD) SystemPrimary Containment Oxygen Concentration .......Secondary Containment ..............Secondary Containment Isolation Valves (SCIVs)Standby Gas Treatment (SGT) System ............

B 3.4-1B 3.4-1B 3.4-11B 3.4-15B 3.4-19B 3.4-24B 3.4-29

B 3.4-33

B 3.4-38B 3.4-43B 3.4-52

B 3.5-1B 3.5-1B 3.5-18B 3.5-24

B 3.6-1B 3.6-1B 3.6-6B 3.6-14B 3.6-31

B 3.6-34B 3.6-42B 3.6-48B 3.6-53

B 3.6-56B 3.6-60B 3.6-64B 3.6-70B 3.6-73B 3.6-78B 3.6-85

B 3.7B 3.7.1B 3.7.2

B 3.7.3B 3.7.4

B 3.7.5

PLANT SYSTEMS ........ . . .........High Pressure Service Water (HPSW) System . . .Emergency Service Water (ESW) System and Normal

Heat Sink . . . . . . . . . . . . . . . . .Emergency Heat Sink ..............Main Control Room Emergency Ventilation (MCREV)

System . . . . . . . . . . . . . . . . . . .Main Condenser Offgas ..............

B 3.7-1B 3.7-1

B 3.7-6B 3.7-11

B 3.7-15B 3.7-22

(continued)

PBAPS UNIT 2 ii Revision No. 0

TABLE OF CONTENTS

B 3.7B 3.7.6B 3.7.7

B 3.8B 3.8.1B 3.8.2B 3.8.3B 3.8.4B 3.8.5B 3.8.6B 3.8.7B 3.8.8

B 3.9B 3.9.1B 3.9.2B 3.9.3B 3.9.4B 3.9.5B 3.9.6B 3.9.7B 3.9.8

B 3.10B 3.10.1B 3.10.2B 3.10.3B 3.10.4B 3.10.5

B 3.10.6B 3.10.7B 3.10.8

PLANT SYSTEMS (continued)Main Turbine Bypass System ................Spent Fuel Storage Pool Water Level ......

ELECTRICAL POWER SYSTEMS ..... ...............AC Sources-Operating .............AC Sources-Shutdown .......................Diesel Fuel Oil, Lube Oil, and Starting AirDC Sources-Operating .............DC Sources-Shutdown ..... ...............Battery Cell Parameters .... .........Distribution Systems-Operating ........Distribution Systems--Shutdown .............

REFUELING OPERATIONS .... ....................Refueling Equipment Interlocks .............Refuel Position One-Rod-Out Interlock .....Control Rod Position ..... ...............Control Rod Position Indication ........Control Rod OPERABILITY-Refueling........Reactor Pressure Vessel (RPV) Water LevelResidual Heat Removal (RHR)-High Water LevelResidual Heat Removal (RHR)-Low Water Level

SPECIAL OPERATIONS ...... ..................Inservice Leak and Hydrostatic Testing OperationReactor Mode Switch Interlock TestingSingle Control Rod Withdrawal--Hot ShutdownSingle Control Rod Withdrawal-Cold ShutdownSingle Control Rod Drive (CRD)

Removal-Refueling .............Multiple Control Rod Withdrawal-Refueling . . .Control Rod Testing-Operating .............SHUTDOWN MARGIN (SDM) Test-Refueling .....

B 3.7-25B 3.7-29

B 3.8-1B 3.8-1B 3.8-40B 3.8-48B 3.8-58B 3.8-72B 3.8-77B 3.8-83B 3.8-94

B 3.9-1B 3.9-IB 3.9-5B 3.9-8B 3.9-10B 3.9-14B 3.9-17B 3.9-20B 3.9-24

B 3.10-1B 3.10- 1B 3.10-5B 3.10-10B 3.10-14

B 3.10-19B 3.10-24B 3.10-27B 3.10-31

PBAPS UNIT 2 iii Revision No. 0

Reactor Core SLsB 2.1.1


B 2.1.1 Reactor Core SLs

BASES

BACKGROUND SLs ensure that specified acceptable fuel design limits arenot exceeded during steady state operation, normaloperational transients, and abnormal operational transients.

The fuel cladding integrity SL is set such that no fueldamage is calculated to occur if the limit is not violated.Because fuel damage is not directly observable, a stepbackapproach is used to establish an SL, such that the MCPR isnot less than the limit specified in Specification 2.1.1.2for General Electric (GE) Company fuel. MCPR greater thanthe specified limit represents a conservative marginrelative to the conditions required to maintain fuelcladding integrity.

The fuel cladding is one of the physical barriers thatseparate the radioactive materials from the environs. Theintegrity of this cladding barrier is related to itsrelative freedom from perforations or cracking. Althoughsome corrosion or use related cracking may occur during thelife of the cladding, fission product migration from thissource is incrementally cumulative and continuouslymeasurable. Fuel cladding perforations, however, can resultfrom thermal stresses, which occur from reactor operationsignificantly above design conditions.

While fission product migration from cladding perforation isjust as measurable as that from use related cracking, thethermally caused cladding perforations signal a thresholdbeyond which still greater thermal stresses may cause gross,rather than incremental, cladding deterioration. Therefore,the fuel cladding SL is defined with a margin to theconditions that would produce onset of transition boiling(i.e., MCPR = 1.00). These conditions represent asignificant departure from the condition intended by designfor planned operation. The MCPR fuel cladding integrity SLensures that during normal operation and during abnormaloperational transients, at least 99.9% of the fuel rods inthe core do not experience transition boiling.

(continued)

PBAPS UNIT 2 B 2.0-1 Revision No. 47


BASES

BACKGROUND(continued)

Operation above the boundary of the nucleate boiling regimecould result in excessive cladding temperature because ofthe onset of transition boiling and the resultant sharpreduction in heat transfer coefficient. Inside the steamfilm, high cladding temperatures are reached, and a claddingwater (zirconium water) reaction may take place. Thischemical reaction results in oxidation of the fuel claddingto a structurally weaker form. This weaker form may loseits integrity, resulting in an uncontrolled release ofactivity to the reactor coolant.

The reactor vessel water level SL ensures that adequate corecooling capability is maintained during all MODES of reactoroperation. Establishment of Emergency Core Cooling Systeminitiation setpoints higher than this safety limit providesmargin such that the safety limit will not be reached orexceeded.

APPLICABLESAFETY ANALYSES

The fuel cladding must not sustain damage as a result ofnormal operation and abnormal operational transients. Thereactor core SLs are established to preclude violation ofthe fuel design criterion that a MCPR limit is to beestablished, such that at least 99.9% of the fuel rods inthe core would not be expected to experience the onset oftransition boiling.

The Reactor Protection System setpoints (LCO 3.3.1.1,"Reactor Protection System (RPS) Instrumentation"), incombination with other LCOs, are designed to prevent anyanticipated combination of transient conditions for ReactorCoolant System water level, pressure, and THERMAL POWERlevel that would result in reaching the MCPR limit.

2.1.1.1 Fuel Cladding Integrity

GE critical power correlations are applicable for allcritical power calculations at pressures z 785 psig and coreflows • 10% of rated flow. For operation at low pressuresor low flows, another basis is used, as follows:

The pressure drop in the bypass region is essentiallyall elevation head with a value > 4.5 psi; therefore,the core pressure drop at low power and flows willalways be > 4.5 psi. At power, the static head inside

(continued)

PBAPS UNIT 2 B 2-0-2 Revision No. 0


BASES

APPLICABLE 2.1.1.1 Fuel Cladding Integrity (continued)SAFETY ANALYSES

the bundle is less than the static head in the, bypassregion because the addition of heat reduces thedensity of the water. At the same time, dynamic headloss in the bundle will be greater than in the bypassregion because of two phase flow effects. Analysesshow that this combination of effects causes bundlepressure drop to be nearly independent of bundle powerwhen bundle flow is 28 X 10' lb/hr and bundle pressuredrop is 3.5 psi. Because core pressure drop at lowpower and flows will always be > 4.5 psi, the bundleflow will be > 28 X 10 ' lb/hr.

Full scale ATLAS test data taken at pressures from14.7 psia (0 psig) to 800 psia (785 psig) indicatethat the fuel assembly critical power with bundle flowat 28 X 10' lb/hr is approximately 3.35 MWt. This isequivalent to a THERMAL POWER > 50% RTP even whendesign peaking factors are considered. Therefore, aTHERMAL POWER limit of 25% RTP prevents any bundlefrom exceeding critical power and is a conservativelimit when reactor pressure < 785 psig.

2.1.1.2 MCPR

The fuel cladding integrity SL is set such that no fueldamage is calculated to occur if the limit is not violated.Since the parameters that result in fu.?l damage are notdirectly observable during reactor operation, the thermaland hydraulic conditions that result in the onset oftransition boiling have been used to mark the beginning ofthe region in which fuel damage could occur. Although it isrecognized that the onset of transitior, boiling would notresult in damage to BWR fuel rods, the critical power atwhich boiling transition is calculated to occur has beenadopted as a convenient limit. However, the uncertaintiesin monitoring the core operating state and in the proceduresused to calculate the critical power result in anuncertainty in the value of the critical power. Therefore,

(conti nued)



BASES

APPLICABLE 2.1.1.2 MCPR (continued)SAFETY ANALYSES

the fuel cladding integrity SL is defined as the criticalpower ratio in the limiting fuel assembly for which morethan 99.9% of the fuel rods in the core are expected toavoid boiling transition, considering the power distributionwithin the core and all uncertainties.

The MCPR SL is determined using a statistical model thatcombines all the uncertainties in operating parameters andthe procedures used to calculate critical power. Theprobability of the occurrence of boiling transition isdetermined using the approved General Electric CriticalPower correlations. Details of the fuel cladding integritySL calculation are given in Reference 1. Reference I alsoincludes a tabulation of the uncertainties used in thedetermination of the MCPR SL and of the nominal values ofthe parameters used in the MCPR SL statistical analysis.

2.1.1.3 Reactor Vessel Water Level

During MODES 1 and 2 the reactor vessel water level isrequired to be above the top of the active fuel to provide 4core cooling capability. With fuel in the reactor vesselduring periods when the reactor is shut down, considerationmust be given to water level requirements due to the effectof decay heat. If the water level should drop below the topof the active irradiated fuel during this period, theability to remove decay heat is reduced. This reduction incooling capability could lead to elevated claddingtemperatures and clad perforation. The core can beadequately cooled as long as water level is above 2/3 of thecore height. The reactor vessel water level SL has beenestablished at the top of the active irradiated fuel toprovide a point that can be monitored and to also provideadequate margin for effective action.

(continued)



BASES (continued)

SAFETY LIMITS The reactor core SLs are established to protect theintegrity of the fuel clad barrier to the release ofradioactive materials to the environs. SL 2.1.1.1 andSL 2.1.1.2 ensure that the core operates within the fueldesign criteria. SL 2.1.1.3 ensures that the reactor vesselwater level is greater than the top of the active irradiatedfuel in order to prevent elevated clad temperatures andresultant clad perforations.

APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in allMODES.

SAFETY LIMITVIOLATIONS

Exceeding an SL may cause fuel damage and create a potentialfor radioactive releases in excess of 10 CFR 100, "ReactorSite Criteria," limits (Ref. 2). Therefore, it is requiredto insert all insertable control rods and restore compliancewith the SLs within 2 hours. The 2 hour Completion Timeensures that the operators take prompt remedial action andalso ensures that the probability of an accident occurringduring this period is minimal.

(continued)



BASES

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application

for Reactor Fuel," latest approved revision.

2. 10 CFR 100.


RCS Pressure SLB 2.1.2


B 2.1.2 Reactor Coolant System (RCS) Pressure SL

BASES

BACKGROUND The SL on reactor steam dome pressure protects the RCSagainst overpressurization. In the event of fuel claddingfailure, fission products are released into the reactorcoolant. The RCS then serves as the primary barrier inpreventing the release of fission products into theatmosphere. Establishing an upper limit on reactor steamdome pressure ensures continued RCS integrity with regard topressure excursions. Per the UFSAR (Ref. 1), the reactorcoolant pressure boundary (RCPB) shall be designed withsufficient margin to ensure that the design conditions arenot exceeded during normal operation and abnormaloperational transients.

During normal operation and abnormal operational transients,RCS pressure is limited from exceeding the design pressureby more than 10%, in accordance with Section III of the ASMECode (Ref. 2). To ensure system integrity, all RCScomponents are hydrostatically tested at 125% of designpressure, in accordance with ASME Code requirements, priorto initial operation when there is no fuel in the core. Anyfurther hydrostatic testing with fuel in the core may bedone under LCO 3.10.1, "Inservice Leak and HydrostaticTesting Operation." Following inception of unit operation,RCS components shall be pressure tested in accordance withthe requirements of ASME Code, Section XI (Ref. 3).

Overpressurization of the RCS could result in a breach ofthe RCPB reducing the number of protective barriers designedto prevent radioactive releases from exceeding the limitsspecified in 10 CFR 100, "Reactor Site Criteria" (Ref. 4).If this occurred in conjunction with a fuel claddingfailure, fission products could enter the containmentatmosphere.

APPLICABLE The RCS safety/relief valves and the Reactor ProtectionSAFETY ANALYSES System Reactor Pressure-High Function have settings

established to ensure that the RCS pressure SL will not beexceeded.

(continued)



BASES


(continued)

The RCS pressure SL has been selected such that it is at apressure below which it can be shown that the integrity ofthe system is not endangered. The reactor pressure vesselis designed to Section Il1, 1965 Edition of the ASME, Boilerand Pressure Vessel Code, including Addenda through thewinter of 1965 (Ref. 5), which permits a maximum pressuretransient of 110%, 1375 psig, of design pressure 1250 psig.The SL of 1325 psig, as measured in the reactor steam dome,is equivalent to 1375 psig at the lowest elevation of theRCS. The RCS is designed to the ASME Section I11, 1980Edition, including Addenda through winter of 1981 (Ref. 6),for the reactor recirculation piping, which permits amaximum pressure transient of 110% of design pressures of1250 psig for suction piping and 1500 psig for dischargepiping. The RCS pressure SL is selected to be the lowesttransient overpressure allowed by the applicable codes.

SAFETY LIMITS The maximum transient pressure allowable in the RCS pressurevessel under the ASME Code, Section III, is 110% of designpressure. The maximum transient pressure allowable in theRCS piping, valves, and fittings is 110% of design pressuresof 1250 psig for suction piping and 1500 psig for dischargepiping. The most limiting of these allowances is the 110%of design pressures of 1250 psig; therefore, the SL onmaximum allowable RCS pressure is established at 1325 psig,as measured at the reactor steam dome.

APPLICABILITY SL 2.1.2 applies in all MODES.


(continued)



BASES


(continued) Exceeding the RCS pressure SL may cause immediate RCSfailure and create a potential for radioactive releases inexcess of 10 CFR 100, "Reactor Site Criteria," limits(Ref. 4). Therefore, it is required to insert allinsertable control rods and restore compliance with the SLwithin 2 hours. The 2 hour Completion Time ensures that theoperators take prompt remedial action and also assures thatthe probability of an accident occurring during the periodis minimal.

REFERENCES 1. UFSAR, Section 1.5.2.2.

2. ASME, Boiler and Pressure Vessel Code, Section Ill,Article NB-7000.

(continued)



BASES

REFERENCES(continued)

3. ASME, Boiler and Pressure Vessel Code, Section XI,Article IW-5000.

4. 10 CFR 100.

5. ASME, Boiler and Pressure Vessel Code, Section 111,1965 Edition, including Addenda to winter of 1965.

6. ASME, Boiler and Pressure Vessel Code, Section III,1980 Edition, Addenda to winter of 1981.


LCO ApplicabilityB 3.0


BASES

LCOs LCO 3.0.1 through LCO 3.0.7 establish the generalrequirements applicable to all Specifications inSections 3.1 through 3.10 and apply at all times, unlessotherwise stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement withineach individual Specification as the requirement for whenthe LCO is required to be met (i.e., when the unit is in theMODES or other specified conditions of the Applicabilitystatement of each Specification).

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure tomeet an LCO, the associated ACTIONS shall be met. TheCompletion Time of each Required Action for an ACTIONSCondition is applicable from the point in time that anACTIONS Condition is entered. The Required Actionsestablish those remedial measures that must be taken withinspecified Completion Times when the requirements of an LCOare not met. This Specification establishes that:

a. Completion of the Required Actions within thespecified Completion Times constitutes compliance witha Specification; and

b. Completion of the Required Actions is not requiredwhen an LCO is met within the specified CompletionTime, unless otherwise specified.

There are two basic types of Required Actions. The firsttype of Required Action specifies a time limit in which theLCO must be met. This time limit is the Completion Time torestore an inoperable system or component to OPERABLE statusor to restore variables to within specified limits. If thistype of Required Action is not completed within thespecified Completion Time, a shutdown may be required toplace the unit in a MODE or condition in which theSpecification is not applicable. (Whether stated as aRequired Action or not, correction of the entered Conditionis an action that may always be considered upon enteringACTIONS.) The second type of Required Action specifies the

(continued)



BASES

LCO 3.0.2 remedial measures that permit continued operation of the(continued) unit that is not further restricted by the Completion Time.

In this case, compliance with the Required Actions providesan acceptable level of safety for continued operation.

Completing the Required Actions is not required when an LCOis met or is no longer applicable, unless otherwise statedin the individual Specifications.

The nature of some Required Actions of some Conditionsnecessitates that, once the Condition is entered, theRequired Actions must be completed even though theassociated Condition no longer exists. The individual LCO'sACTIONS specify the Required Actions where this is the case.An example of this is in LCO 3.4.9, "RCS Pressure andTemperature Limits."

The Completion Times of the Required Actions are alsoapplicable when a system or component is removed fromservice intentionally. The reasons for intentionallyrelying on the ACTIONS include, but are not limited to,performance of Surveillances, preventive maintenance,corrective maintenance, or investigation of operationalproblems. Entering ACTIONS for these reasons must be donein a manner that does not compromise safety. Intentionalentry into ACTIONS should not be made for operationalconvenience. Alternatives that would not result inredundant equipment being inoperable should be used instead.Doing so limits the time both subsystems/divisions of asafety function are inoperable and limits the time otherconditions exist which result in LCO 3.0.3 being entered.Individual Specifications may specify a time limit forperforming an SR when equipment is removed from service orbypassed for testing. In this case, the Completion Times ofthe Required Actions are applicable when this time limitexpires, if the equipment remains removed from service orbypassed.

When a change in MODE or other specified condition isrequired to comply with Required Actions, the unit may entera MODE or other specified condition in which anotherSpecification becomes applicable. In this case, theCompletion Times of the associated Required Actions wouldapply from the point in time that the new Specificationbecomes applicable and the ACTIONS Condition(s) are entered.

(continued)



BASES (continued)

LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implementedwhen an LCO is not met and:

a. An associated Required Action and Completion Time isnot met and no other Condition applies; or

b. The condition of the unit is not specificallyaddressed by the associated ACTIONS. This means thatno combination of Conditions stated in the ACTIONS canbe made that exactly corresponds to the actualcondition of the unit. Sometimes, possiblecombinations of Conditions are such that enteringLCO 3.0.3 is warranted; in such cases, the ACTIONSspecifically state a Condition corresponding to suchcombinations and also that LCO 3.0.3 be enteredimmediately.

This Specification delineates the time limits for placingthe unit in a safe MODE or other specified condition whenoperation cannot be maintained within the limits for safeoperation as defined by the LCO and its ACTIONS. It is notintended to be used as an operational convenience thatpermits routine voluntary removal of redundant systems orcomponents from service in lieu of other alternatives thatwould not result in redundant systems or components beinginoperable.

Upon entering LCO 3.0.3, 1 hour is allowed to prepare for anorderly shutdown before initiating a change in unitoperation. This includes time to permit the operator tocoordinate the reduction in electrical generation with theload dispatcher to ensure the stability and availability ofthe electrical grid. The time limits specified to reachlower MODES of operation permit the shutdown to proceed in acontrolled and orderly manner that is well within thespecified maximum cooldown rate and within the capabilitiesof the unit, assuming that only the minimum requiredequipment is OPERABLE. This reduces thermal stresses oncomponents of the Reactor Coolant System and the potentialfor a plant upset that could challenge safety systems underconditions to which this Specification applies. The use andinterpretation of specified times to complete the actions ofLCO 3.0.3 are consistent with the discussion of Section 1.3,Completion Times.

(cdntinued)



BASES

LCO 3.0.3 A unit shutdown required in accordance with LCO 3.0.3 may be(continued) terminated and LCO 3.0.3 exited if any of the following

occurs:

a. The LCO is now met.

b. A Condition exists for which the Required Actions havenow been performed.

c. ACTIONS exist that do not have expired CompletionTimes. These Completion Times are applicable from thepoint in time that the Condition is initially enteredand not from the time LCO 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours forthe unit to be in MODE 4 when a shutdown is required duringMODE 1 operation. If the unit is in a lower MODE ofoperation when a shutdown is required, the time limit forreaching the next lower MODE applies. If a lower MODE isreached in less time than allowed, however, the totalallowable time to reach MODE 4, or other applicable MODE, isnot reduced. For example, if MODE 2 is reached in 2 hours,then the time allowed for reaching MODE 3 is the next11 hours, because the total time for reaching MODE 3 is notreduced from the allowable limit of 13 hours. Therefore, ifremedial measures are completed that would permit a returnto MODE 1, a penalty is not incurred by having to reach alower MODE of operation in less than the total time allowed.

In MODES 1, 2, and 3, LCO 3.0.3 provides actions forConditions not covered in other Specifications. Therequirements of LCO 3.0.3 do not apply in MODES 4 and 5because the unit is already in the most restrictiveCondition required by LCO 3.0.3. The requirements ofLCO 3.0.3 do not apply in other specified conditions of theApplicability (unless in MODE 1, 2, or 3) because theACTIONS of individual Specifications sufficiently define theremedial measures to be taken.

Exceptions to LCO 3.0.3 are provided in instances whererequiring a unit shutdown, in accordance with LCO 3.0.3,would not provide appropriate remedial measures for theassociated condition of the unit. An example of this is inLCO 3.7.7, "Spent Fuel Storage Pool Water Level." LCO 3.7.7has an Applicability of "During movement of fuel assemblies

(continued)



BASES

LCO 3.0.3(continued)

in the spent fuel storage pool." Therefore, this LCO can beapplicable in any or all MODES. If the LCO and the RequiredActions of LCO 3.7.7 are not met while in MODE 1, 2, or 3,there is no safety benefit to be gained by placing the unitin a shutdown condition. The Required Action of LCO 3.7.7of "Suspend movement of fuel assemblies in the spent fuelstorage pool" is the appropriate Required Action to completein lieu of the actions of LCO 3.0.3. These exceptions areaddressed in the individual Specifications.

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES orother specified conditions in the Applicability when an LCOis not met. It allows placing the unit in a MODE or otherspecified condition stated in that Applicability (e.g., theApplicability desired to be entered) when unit conditionsare such that the requirements of the LCO would not be met,in accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.

LCO 3.0.4.a allows entry into a MODE or other specifiedcondition in the Applicability with the LCO not met when theassociated ACTIONS to be entered permit continued operationin the MODE or other specified condition in theApplicability for an unlimited period of time. Compliancewith Required Actions that permit continued operation of theunit for an unlimited period of time in a MODE or otherspecified condition provides an acceptable level of safetyfor continued operation. This is without regard to thestatus of the unit before or after the MODE change.Therefore, in such cases, entry into a MODE or otherspecified condition in the Applicability may be made inaccordance with the provisions of the Required Actions.

LCO 3.0.4.b allows entry into a MODE or other specifiedcondition in the Applicability with the LCO not met afterperformance of a risk assessment addressing inoperablesystems and components, consideration of the results,determination of the acceptability of entering the MODE orother specified condition in the Applicability, andestablishment of risk management actions, if appropriate.

The risk assessment may usequantitative, qualitative, orblended approaches, and the risk assessment will beconducted using the plant program, procedures, and criteriain place to implement 10 CFR 50.65(a)(4), which requiresthat risk impacts of maintenance activities be assessed andmanaged. The risk assessment, for the purposes of LCO3.0.4.b, must take into account all inoperable TechnicalSpecification equipment regardless of whether the equipmentis included in the normal 10 CFR 50.65(a)(4) risk assessmentscope. The risk assessments will be conducted using theprocedures and guidance endorsed by Regulatory Guide 1.182,"Assessing and Managing Risk Before Maintenance Activitiesat Nuclear Power Plants." Regulatory Guide 1.182 endorsesthe guidance in Section 11 of NUMARC 93-01, "Industry

(continued)



BASES


Guideline for Monitoring the Effectiveness of Maintenance atNuclear Power Plants." These documents address generalguidance for conduct of the risk assessment, quantitativeand qualitative guidelines for establishing risk managementactions, and example risk management actions. These includeactions to plan and conduct other activities in a mannerthat controls overall risk, increased risk awareness byshift and management personnel, actions to reduce theduration of the condition, actions to minimize the magnitudeof risk increases (establishment of backup success paths orcompensatory measures), and determination that the proposedMODE change is acceptable. Consideration should also begiven to the probability of completing restoration such thatthe requirements of the LCO would be met prior to theexpiration of ACTIONS Completion Times that would requireexiting the Applicability.

LCO 3.0.4.b may be used with single, or multiple systems andcomponents unavailable. NUMARC 93-01 provides guidancerelative to consideration of simultaneous unavailability ofmultiple systems and components.

The results of the risk assessment shall be considered indetermining the acceptability of entering the MODE or otherspecified condition in the Applicability, and anycorresponding risk management actions. The LCO 3.0.4.b risk,assessments do not have to be documented.

The Technical Specifications allow continued operation withequipment unavailable in MODE 1 for the duration of theCompletion Time. Since this is allowable, and since ingeneral the risk impact in that particular MODE boundstherisk of transitioning into and through the applicable MODESor other specified conditions in the Applicability of theLCO, the use of the LCO 3.0.4.b allowance should begenerally acceptable, as long as the risk is assessed andmanaged as stated above. However, there is a small subsetof systems and components that have been determined to bemore important to risk and use of the LCO 3.0.4.b allowanceis prohibited. The LCOs governing these system andcomponents contain Notes prohibiting the use of LCO 3.0.4.bby stating that LCO 3.0.4.b is not applicable.

LCO 3.0.4.c allows entry into a MODE or other specifiedcondition in the Applicability with the LCO not met based ona Note in the Specification which states LCO 3.0.4.c isapplicable. These specific allowances permit entry intoMODES or other specified conditions in the Applicabilitywhen the associated ACTIONS to be entered do not provide forcontinued operation for an unlimited period of time and arisk assessment has not been performed. This allowance mayapply to all the ACTIONS or to a specific Required Action ofa Specification. The risk assessments performed to justifythe use of LCO 3.0.4.b usually only consider systems andcomponents. For this reason, LCO 3.0.4.c is typicallyapplied to Specifications which describe values and

(continued)

*

0PBAPS UNIT 2 B 3.0-5a Revision No. 52 I


BASES

LCO 3.0.4 parameters (e.g., Reactor Coolant System specific activity),(continued) and may be applied to other Specifications based on NRC

plant-specific approval.

The provisions of this Specification should not beinterpreted as endorsing the failure to exercise the goodpractice of restoring systems or components to OPERABLEstatus before entering an associated MODE or other specifiedcondition in the Applicability.

The provisions of LCO 3.0.4 shall not prevent changes inMODES or other specified conditions in the Applicabilitythat are required to comply with ACTIONS. In addition, theprovisions of LCO 3.0.4 shall not prevent changes in MODESor other specified conditions in the Applicability thatresult from any unit shutdown. In this context, a unitshutdown is defined as a change in MODE or other specifiedcondition in the Applicability associated with transitioningfrom MODE 1 to MODE 2, MODE 2 to MODE 3, and MODE 3 toMODE 4.

Upon entry into a MODE or other specified condition in theApplicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2require entry into the applicable Conditions and RequiredActions until the Condition is resolved, until the LCO ismet, or until the unit is not within the Applicability ofthe Technical Specification.

Surveillances do not have to be performed on the associatedinoperable equipment (or on variables outside the specifiedlimits), as permitted by SR 3.0.1. Therefore, utilizingLCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for anySurveillances that have not been performed on inoperableequipment. However, SRs must be met to ensure OPERABILITYprior to declaring the associated equipment OPERABLE (orvariable within limits) and restoring compliance with theaffected LCO.

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipmentto service under administrative controls when it has beenremoved from service or declared inoperable to comply withACTIONS. The sole purpose of this Specification is toprovide an exception to LCO 3.0.2 (e.g., to not comply withthe applicable Required Action(s)) to allow the performanceof SRs to demonstrate:

a. The OPERABILITY of the equipment being returned toservice; or

b. The OPERABILITY of other equipment.

(continued)



BASES


The administrative controls ensure the time the equipment isreturned to service in conflict with the requirements of theACTIONS is limited to the time absolutely necessary toperform the allowed SRs. This Specification does notprovide time to perform any other preventive or correctivemaintenance.

An example of demonstrating the OPERABILITY of the equipmentbeing returned to service is reopening a containmentisolation valve that has been closed to comply with RequiredActions and must be reopened to perform the SRs.

An example of demonstrating the OPERABILITY of otherequipment is taking an inoperable channel or trip system outof the tripped condition to prevent the trip function fromoccurring during the performance of an SR on another channelin the other trip system. A similar example ofdemonstrating the OPERABILITY of other equipment is takingan inoperable channel or trip system out of the trippedcondition to permit the logic to function and indicate theappropriate response during the performance of an SR onanother channel in the same trip system.

LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for supportsystems that have an LCO specified in the TechnicalSpecifications (TS). This exception is provided becauseLCO 3.0.2 would require that the Conditions and RequiredActions of the associated inoperable supported system LCO beentered solely due to the inoperability of the supportsystem. This exception is justified because the actionsthat are required to ensure the plant is maintained in asafe condition are specified in the support systems' LCO'sRequired Actions. These Required Actions may includeentering the supported system's Conditions and RequiredActions or may specify other Required Actions.

When a support system is inoperable and there is an LCOspecified for it in the TS, the supported system(s) arerequired to be declared inoperable if determined to beinoperable as a result of the support system inoperability.However, it is not necessary to enter into the supportedsystems' Conditions and Required Actions unless directed todo so by the support system's Required Actions. Thepotential confusion and inconsistency of requirementsrelated to the entry into multiple support and supported

(continued)



BASES

LCO 3.0.6 systems' LCOs' Conditions and Required Actions are(continued) eliminated by providing all the actions that are necessary

to ensure the plant is maintained in a safe condition in thesupport system's Required Actions.

However, there are instances where a support system'sRequired Action may either direct a supported system to bedeclared inoperable or direct entry into Conditions andRequired Actions for the supported system. This may occurimmediately or after some specified delay to perform someother Required Action. Regardless of whether it isimmediate or after some delay, when a support system'sRequired Action directs a supported system to be declaredinoperable or directs entry into Conditions and RequiredActions for a supported system, the applicable Conditionsand Required Actions shall be entered in accordance withLCO 3.0.2.

Specification 5.5.11, "Safety Function Determination Program(SFDP)," ensures loss of safety function is detected andappropriate actions are taken. Upon entry into LCO 3.0.6,an evaluation shall be made to determine if loss of safetyfunction exists. Additionally, other limitations, remedialactions, or compensatory actions may be identified as aresult of the support system inoperability and correspondingexception to entering supported system Conditions andRequired Actions. The SFDP implements the requirements ofLCO 3.0.6.

Cross division checks to identify a loss of safety functionfor those support systems that support safety systems arerequired. The cross division check verifies that thesupported systems of the redundant OPERABLE support systemare OPERABLE, thereby ensuring safety function is retained.If this evaluation determines that a loss of safety functionexists, the appropriate Conditions and Required Actions ofthe LCO in which the loss of safety function exists arerequired to be entered.

LCO 3.0.7 There are certain special tests and operations required tobe performed at various times over the life of the unit.These special tests and operations are necessary todemonstrate select unit performance characteristics, toperform special maintenance activities, and to perform

(continued)



BASES


special evolutions. Special Operations LCOs in Section 3.10allow specified TS requirements to be changed to permitperformances of these special tests and operations, whichotherwise could not be performed if required to comply withthe requirements of these TS. Unless otherwise specified,all the other TS requirements remain unchanged. This willensure all appropriate requirements of the MODE or otherspecified condition not directly associated with or requiredto-be changed to perform the special test or operation willremain in effect.

The Applicability of a Special Operations LCO represents acondition not necessarily in compliance with the normalrequirements of the TS. Compliance with Special OperationsLCOs is optional. A special operation may be performedeither under the provisions of the appropriate SpecialOperations LCO or under the other applicable TSrequirements. If it is desired to perform the specialoperation under the provisions of the Special OperationsLCO, the requirements of the Special Operations LCO shall befollowed. When a Special Operations LCO requires anotherLCO to be met, only the requirements of the LCO statementare required to be met regardless of that LCO'sApplicability (i.e., should the requirements of this otherLCO not be met, the ACTIONS of the Special Operations LCOapply, not the ACTIONS of the other LCO). However, thereare instances where the Special Operations LCO's ACTIONS maydirect the other LCO's ACTIONS be met. The Surveillances ofthe other LCO are not required to be met, unless specifiedin the Special Operations LCO. If conditions exist suchthat the Applicability of any other LCO is met, all theother LCO's requirements (ACTIONS and SRs) are required tobe met concurrent with the requirements of the SpecialOperations LCO.


SR ApplicabilityB 3.0

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY

BASES

SRs SR 3.0.1 through SR 3.0.4 establish the general requirementsapplicable to all Specifications in Sections 3.1 through3.10 and apply at all times, unless otherwise stated.

SR 3.0.1 SR%3.0.1 establishes the requirement that SRs must be metduring the MODES or other specified conditions in theApplicability for which the requirements of the LCO apply,unless otherwise specified in the individual SRs. ThisSpecification is to ensure that Surveillances are performedto verify the OPERABILITY of systems and components, andthat variables are within specified limits. Failure to meeta Surveillance within the specified Frequency, in accordancewith SR 3.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be OPERABLE when theassociated SRs have been met. Nothing in thisSpecification, however, is to be construed as implying thatsystems or components are OPERABLE when:

a. The systems or components are known to be inoperable,although still meeting the SRs; or

b. The requirements of the Surveillance(s) are known tobe not met between required Surveillance performances.

Surveillances do not have to be performed when the unit isin a MODE or other specified condition for which therequirements of the associated LCO are not applicable,unless otherwise specified. The SRs associated with aSpecial Operations LCO are only applicable when the SpecialOperations LCO is used as an allowable exception to therequirements of a Specification.

Surveillances, including Surveillances invoked by RequiredActions, do not have to be performed on inoperable equipmentbecause the ACTIONS define the remedial measures that apply.Surveillances have to be met and performed in accordancewith SR 3.0.2, prior to returning equipment to OPERABLEstatus.

(continued)



BASES

SR 3.0.1(continued)

Upon completion of maintenance, appropriate post maintenancetesting is required to declare equipment OPERABLE. Thisincludes ensuring applicable Surveillances are not failedand their most recent performance is in accordance withSR 3.0.2. Post maintenance testing may not be possible inthe current MODE or other specified conditions in theApplicability due to the necessary unit parameters nothaving been established. In these situations, the equipmentmay be considered OPERABLE provided testing has beensatisfactorily completed to the extent possible and theequipment is not otherwise believed to be incapable ofperforming its function. This will allow operation toproceed to a MODE or other specified condition where othernecessary post maintenance tests can be completed.

Some examples of this process are:

a. Control Rod Drive maintenance during refueling thatrequires scram testing at > 800 psi. However, ifother appropriate testing is satisfactorily completedand the scram time testing of SR 3.1.4.3 is satisfied,the control rod can be considered OPERABLE. Thisallows startup to proceed to reach 800 psi to performother necessary testing.

b. High pressure coolant injection (HPCI) maintenanceduring shutdown that requires system functional testsat a specified pressure. Provided other appropriatetesting is satisfactorily completed, startup canproceed with HPCI considered OPERABLE. This allowsoperation to reach the specified pressure to completethe necessary post maintenance testing.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting thespecified Frequency for Surveillances and any RequiredAction with a Completion Time that requires the periodicperformance of the Required Action on a "once per..."interval.

SR 3.0.2 permits a 25% extension of the interval specifiedin the Frequency. This extension facilitates Surveillancescheduling and considers plant operating conditions that maynot be suitable for conducting the Surveillance (e.g.,transient conditions or other ongoing Surveillance ormaintenance activities).

(continued)



BASES

SR 3.0.2(continued)

The 25% extension does not significantly degrade thereliability that results from performing the Surveillance atits specified Frequency. This is based on the recognitionthat the most probable result of any particular Surveillancebeing performed is the verification of conformance with theSRs. The exceptions to SR 3.0.2 are those Surveillances forwhich the 25% extension of the interval specified in theFrequency does not apply. These exceptions are stated inthe individual Specifications. The requirements ofregulations take precedence over the TS. Therefore, when atest interval is specified in the regulations, the testinterval cannot be extended by the TS, and the SR include aNote in the Frequency stating, "SR 3.0.2 is not applicable."An example of an exception when the test interval is notspecified in the regulations is the Note in the PrimaryContainment Leakage Rate Testing Program, "SR 3.0.2 is notapplicable." This exception -is provided because the programalready includes extension of test intervals.

As stated in SR 3.0.2, the 25% extension also does not applyto the initial portion of a periodic Completion Time thatrequires performance on a "once per..." basis. The 25%extension applies to each performance after the initialperformance. The initial performance of the RequiredAction, whether it is a particular Surveillance or someother remedial action, is considered a single action with asingle Completion Time. One reason for not allowing the 25%extension to this Completion Time is that such an actionusually verifies that no loss of function has occurred bychecking the status of redundant or diverse components oraccomplishes the function of the inoperable equipment in analternative manner.

The provisions of SR 3.0.2 are not intended to be usedrepeatedly merely as an operational convenience to extendSurveillance intervals (other than those consistent withrefueling intervals) or periodic Completion Time intervalsbeyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaringaffected equipment inoperable or an affected variableoutside the specified limits when a Surveillance has notbeen completed within the specified Frequency. A delayperiod of up to 24 hours or up to the limit of the specified

(continued)


SR ApplicabilityB3.0

BASES

SR 3.0.3 Frequency, whichever is greater, applies from the point in(continued) time that it is discovered that the Surveillance has not been

performed in accordance with SR 3.0.2, and not at the timethat the specified Frequency was not met.

This delay period provides adequate time to completeSurveillances that have been missed. This delay periodpermits the completion of a Surveillance before complyingwith Required Actions or other remedial measures that mightpreclude completion of the Surveillance.

The basis for this delay period includes consideration ofunit conditions, adequate planning, availability ofpersonnel, the time required to perform the Surveillance,the safety significance of the delay in completing therequired Surveillance, and the recognition that the mostprobable result of any particular Surveillance beingperformed is the verification of conformance with therequirements.

When a Surveillance with a Frequency based not on timeintervals, but upon specified unit conditions, operatingsituations, or requirements of regulations (e.g., prior toentering MODE 1 after each fuel loading, or in accordancewith 10 CFR 50, Appendix J, as modified by approvedexemptions, etc.) is discovered to not have been performedwhen specified, SR 3.0.3 allows for the full delay period ofup to the specified Frequency to perform the Surveillance.However, since there is not a time interval specified, themissed Surveillance should be performed at the firstreasonable opportunity.

SR 3.0.3 provides a time limit for, and allowances for theperformance of, Surveillances that become applicable as aconsequence of MODE changes imposed by Required Actions.

Failure to comply with specified Frequencies for SRs isexpected to be an infrequent occurrence. Use of the delayperiod established by SR 3.0.3 is a flexibility which is notintended to be used as an operational convenience to extendSurveillance intervals. While up to 24 hours or the limitof the specified Frequency is provided to perform the missedSurveillance, it isexpected that the missed Surveillancewill be performed at the first reasonable opportunity. Thedetermination of the first reasonable opportunity shouldinclude consideration of the impact on plant risk (fromdelaying the Surveillance as well as any plant configurationchanges required or shutting the plant down to perform theSurveillance) and impact on any analysis assumptions, inaddition to unit conditions, planning, availability ofpersonnel, and the time required to perform theSurveillance. This risk impact should be managed through

(continue'd)



BASES

SR 3.0.3(continued)

the program in place to implement 10 CFR 50.65(a)(4) and itsimplementation guidance, NRC Regulatory Guide 1.182,'Assessing and Managing Risk Before Maintenance Activitiesat Nuclear Power Plants.' This Regulatory Guide addressesconsideration of temporary and aggregate risk impacts,determination of risk management action thresholds, and riskmanagement action up to and including plant shutdown. Themissed Surveillance should be treated as an emergentcondition as discussed in the Regulatory Guide. The riskevaluation may use quantitative, qualitative, or blendedmethods. The degree of depth and rigor of the evaluationshould be commensurate with the importance of the component.Missed Surveillances for important components should beanalyzed quantitatively. If the results of the riskevaluation determine the risk increase is significant, thisevaluation should be used to determine the safest course ofaction. All missed Surveillances will be placed in thelicensee's Corrective Action Program.

If a Surveillance is not completed within the allowed delayperiod, then the equipment is considered inoperable or thevariable is considered outside the specified limits and theCompletion Times of the Required Actions for the applicableLCO Conditions begin immediately upon expiration of thedelay period. If a Surveillance is failed within the delayperiod, then the equipment is inoperable, or the variable isoutside the specified limits and the Completion Times of theRequired Actions for the applicable LCO Conditions beginimmediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay periodallowed by this Specification, or within the Completion Timeof the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRsmust be met before entry into a MODE or other specifiedcondition in the Applicability.

This Specification ensures that system and componentOPERABILITY requirements and variable limits are met beforeentry into MODES or other specified conditions in theApplicability for which these systems and components ensuresafe operation of the unit. The provisions of thisSpecification should not be interpreted as endorsing thefailure to exercise the good practice of restoring systemsor components to OPERABLE status before entering anassociated MODE or other specified condition in theApplicability.

A provision is included to allow entry into a MODE or otherspecified condition in the Applicability when an LCO is notmet due to Surveillance not being met in accordance with LCO3.0.4.

(continued)



BASES

SR 3.0.4(continued)

However, in certain circumstances, failing to meet an SRwill not result in SR 3.0.4 restricting a MODE change orother specified condition change. When a system, subsystem,division, component, device, or variable is inoperable oroutside its specified limits, the associated SR(s) are notrequired to be performed, per SR 3.0.1, which states thatsurveillances do not have to be performed on inoperableequipment. When equipment is inoperable, SR 3.0.4 does notapply to the associated SR(s) since the requirement for theSR(s) to be performed is removed. Therefore, failing toperform the Surveillance(s) within the specified Frequencydoes not result in an SR 3.0.4 restriction to changing MODESor other specified conditions of the Applicability.However, since the LCO is not met in this instance,LCO 3.0.4 will govern any restrictions that may (or may not)apply to MODE or other specified condition changes. SR3.0.4 does not restrict changing MODES or other specifiedconditions of the Applicability when a Surveillance has notbeen performed within the specified Frequency, provided therequirement to declare the LCO not met has been delayed inaccordance with SR 3.0.3.

The provisions of SR 3.0.4 shall not prevent entry intoMODES or other specified conditions in the Applicabilitythat are required to comply with ACTIONS. In addition, theprovisions of SR 3.0.4 shall not prevent changes in MODES orother specified conditions in the Applicability that resultfrom any unit shutdown. In this context, a unit shutdown isdefined as a change in MODE or other specified condition inthe Applicability associated with transitioning from MODE Ito MODE 2, MODE 2 to MODE 3, and MODE 3 to MODE 4.

The precise requirements for performance of SRs arespecified such that exceptions to SR 3.0.4 are notnecessary. The specific time frames and conditionsnecessary for meeting the SRs are specified in theFrequency, in the Surveillance, or both. This allowsperformance of Surveillances when the prerequisitecondition(s) specified in a Surveillance procedure requireentry into the MODE or other specified condition in theApplicability of the associated LCO prior to the performanceor completion of a Surveillance. A Surveillance that couldnot be performed until after entering the LCO'sApplicability, would have its Frequency specified such thatit is not "due" until the specific conditions needed aremet. Alternately, the Surveillance may be stated in theform of a Note, as not required (to be met or performed)until a particular event, condition, or time has beenreached. Further discussion of the specific formats of SRs'annotation is found in Section 1.4, Frequency.

40


SDMB 3.1.1


B 3.1.1 SHUTDOWN MARGIN (SDM)

BASES

BACKGROUND SDM requirements are specified to ensure:

a. The reactor can be made subcritical from all operatingconditions and transients and Design Basis Events;

b. The reactivity transients associated with postulatedaccident conditions are controllable within acceptablelimits; and

c. The reactor will be maintained sufficientlysubcritical to preclude inadvertent criticality in theshutdown condition.

These requirements are satisfied by the control rods, asdescribed in the UFSAR Section 1.5 (Ref. 1), which cancompensate for the reactivity effects of the fuel and watertemperature changes experienced during all operatingconditions.


The control rod drop accident (CRDA) analysis (Refs. 2and 3) assumes the core is subcritical with the highestworth control rod withdrawn. Typically, the first controlrod withdrawn has a very high reactivity worth and, shouldthe core be critical during the withdrawal of'the firstcontrol rod, the consequences of a CRDA could exceed thefuel damage limits for a CRDA (see Bases for LCO 3.1.6, "RodPattern Control"). Also, SDM is assumed as an initialcondition for the control rod removal error during refueling(Ref. 4) and fuel assembly insertion error during refueling(Ref. 5) accidents. The analysis of these reactivityinsertion events assumes the refueling interlocks areOPERABLE when the reactor is in the refueling mode ofoperation. These interlocks prevent the withdrawal of morethan one control rod from the core during refueling.(Special consideration and requirements for multiple controlrod withdrawal during refueling are covered in SpecialOperations LCO 3.10.6, "Multiple Control RodWithdrawal -Refueling.") The analysis assumes thiscondition is acceptable since the core will be shut downwith the highest worth control rod withdrawn, if adequate

(continued)


SDMB 3.1.1

BASES

ACTIONS A.1 (continued)

acceptable, considering that the reactor can still be shutdown, assuming no failures of additional control rods toinsert, and the low probability of an event occurring duringthis interval.

B.]

If the SDM cannot be restored, the plant must be brought toMODE 3 in 12 hours, to prevent the potential for furtherreductions in available SDM (e.g., additional stuck controlrods). The allowed Completion Time of 12 hours isreasonable, based on operating experience, to reach MODE 3from full power conditions -in an orderly manner and withoutchallenging plant systems.

C.]

With SDM not within limits in MODE 3, the operator mustimmediately initiate action to fully insert all insertablecontrol rods. Action must continue until all insertablecontrol rods are fully inserted. This action results in theleast reactive condition for the core.

D.I, D.2, D.3, and D.4

With SDM not within limits in MODE 4, the operator mustimmediately initiate action to fully insert all insertablecontrol rods. Action must continue until all insertablecontrol rods are fully inserted. This action results in theleast reactive condition for the core. Action must also beinitiated within 1 hour to provide means for control ofpotential radioactive releases. This includes ensuringsecondary containment is OPERABLE; at least one Standby GasTreatment (SGT) subsystem for Unit 2 is OPERABLE; andsecondary containment isolation capability (i.e., at leastone secondary containment isolation valve and associatedinstrumentation are OPERABLE, or other acceptableadministrative controls to assure isolation capability), ineach associated secondary containment penetrationflow path not isolated that is assumed to be isolated tomitigate radioactivity releases. This may be performed as

(continued)


SDMB 3.1.1

BASES

ACTIONS D.1, D.2, D.3, and D.4 (continued)

an administrative check, by examining logs or otherinformation, to determine if the components are out ofservice for maintenance or other reasons. It is notnecessary to perform the surveillances needed to demonstratethe OPERABILITY of the components. If, however, anyrequired component is inoperable, then it must be restoredto-OPERABLE status. In this case, SRs may need to beperformed to restore the component to OPERABLE status.Actions must continue until all required components areOPERABLE.

E.1, E.2. E.3, E.4, and E.5

With SDM not within limits in MODE 5, the operator mustimmediately suspend CORE ALTERATIONS that could reduce SDM,e.g., insertion of fuel in the core or the withdrawal ofcontrol rods. Suspension of these activities shall notpreclude completion of movement of a component to a safecondition. Inserting control rods or removing fuel from thecore will reduce the total reactivity and are thereforeexcluded from the suspended actions.

Action must also be immediately initiated to fully insertall insertable control rods in core cells containing one ormore fuel assemblies. Action must continue until allinsertable control rods in core cells containing one or morefuel assemblies have been fully inserted. Control rods incore cells containing no fuel assemblies do not affect thereactivity of the core and therefore do not have to beinserted.

Action must also be initiated within I hour to provide meansfor control of potential radioactive releases. Thisincludes ensuring secondary containment is OPERABLE; atleast one SGT subsystem for Unit 2 is OPERABLE; andsecondary containment isolation capability (i.e., at leastone secondary containment isolation valve and associatedinstrumentation are OPERABLE, or other acceptableadministrative controls to assure isolation capability), ineach associated secondary containment penetration flow pathnot isolated that is assumed to be isolated to mitigateradioactive releases. This may be performed as anadministrative check, by examining logs or other

(continued)


SDMB 3.1.1

BASES

ACTIONS E.1, E.2. E.3, E.4, and E.5 (continued)

information, to determine if the components are out ofservice for maintenance or other reasons. It is notnecessary to perform the SRs needed to demonstrate theOPERABILITY of the components. If, however, any requiredcomponent is inoperable, then it must be restored toOPERABLE status. In this case, SRs may need to be performedto-restore the component to OPERABLE status. Action mustcontinue until all required components are OPERABLE.

SURVEILLANCE SR 3.1.1.1REQUIREMENTS

Adequate SDM must be verified to ensure that the reactor canbe made subcritical from any initial operating condition.This can be accomplished by a test, an evaluation, or acombination of the two. Adequate SDM is demonstrated beforeor during the first startup after fuel movement or shufflingwithin the reactor pressure vessel, or control rodreplacement. Control rod replacement refers to thedecoupling and removal of a control rod from a corelocation, and subsequent replacement with a new control rodor a control rod from another core location. Since corereactivity will vary during the cycle as a function of fueldepletion and poison burnup, the beginning of cycle (BOC)test must also account for changes in core reactivity duringthe cycle. Therefore, to obtain the SDM, the initialmeasured value must be increased by an adder, "R", which isthe difference between the calculated value of maximum corereactivity during the operating cycle and the calculated BOCcore reactivity. If the value of R is negative (that is,BOC is the most reactive point in the cycle), no correctionto the BOC measured value is required (Ref. 7). For the SDMdemonstrations that rely solely on calculation of thehighest worth control rod, additional margin (O.10%Ak/k)must be added to the SDM limit of O.28% Ak/k to account foruncertainties in the calculation.

The SDM may be demonstrated during an in sequence controlrod withdrawal, in which the highest worth control rod isanalytically determined, or during local criticals, wherethe highest worth control rod is determined by testing.Local critical tests require the withdrawal of out of

(continued)


SDMB 3.1.1

BASES

SURVEILLANCE SR 3.1.1.1 (continued)REQUIREMENTS

sequence control rods. This testing would therefore requirebypassing of the Rod Worth Minimizer to allow the out ofsequence withdrawal, and therefore additional requirementsmust be met (see LCO 3.10.7, "Control Rod Testing-Operating").

The Frequency of 4 hours after reaching criticality isallowed to provide a reasonable amount of time to performthe required calculations and have appropriate verification.

During MODES 3 and 4, analytical calculation of SDM may beused to assure the requirements of SR 3.1.1.1 are met.During MODE 5, adequate SDM is required to ensure that thereactor does not reach criticality during control rodwithdrawals. An evaluation of each in vessel fuel movementduring fuel loading (including shuffling fuel within thecore) is required to ensure adequate SDM is maintainedduring refueling. This evaluation ensures that theintermediate loading patterns are bounded by the safetyanalyses for the final core loading pattern. For example,bounding analyses that demonstrate adequate SDM for the mostreactive configurations during the refueling may beperformed to demonstrate acceptability of the entire fuelmovement sequence. These bounding analyses includeadditional margins to the associated uncertainties. Spiraloffload/reload sequences, including modified quadrant spiraloffload/reload sequences, inherently satisfy the SR,provided the fuel assemblies are reloaded in the sameconfiguration analyzed for the new cycle. Removing fuelfrom the core will always result in an increase in SDM.

REFERENCES 1. UFSAR, Sections 1.5.1.8 and 1.5.2.2.7.

2. UFSAR, Section 14.6.2.

3. NEDE-24011-P-A-10-US, "General Electric StandardApplication for Reactor Fuel," Supplement for UnitedStates, Section S.2.2.3.1, February 1991.

4. UFSAR, Section 14.5.3.3.


(continued)


SDMB 3.1.1

BASES

REFERENCES 6. UFSAR, Section 3.6.5.4.(continued)

7. NEDE-24011-P-A-1O, "General Electric StandardApplication for Reactor Fuel," Section 3.2.4.1,February 1991.


Reactivity AnomaliesB 3.1.2


B 3.1.2 Reactivity Anomalies

BASES

BACKGROUND In accordance with the UFSAR (Ref. 1), reactivity shall becontrollable such that subcriticality is maintained undercold conditions and acceptable fuel design limits are notexceeded during normal operation and abnormal operationaltransients. Therefore, reactivity anomaly is used as ameasure of the predicted versus measured core reactivityduring power operation. The continual confirmation of corereactivity is necessary to ensure that the Design BasisAccident (DBA) and transient safety analyses remain valid.A large reactivity anomaly could be the result ofunanticipated changes in fuel reactivity or control rodworth or operation at conditions not consistent with thoseassumed in the predictions of core reactivity, and couldpotentially result in a loss of SDM or violation ofacceptable fuel design limits. Comparing predicted versusmeasured core reactivity validates the nuclear methods usedin the safety analysis and supports the SDM demonstrations(LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in assuring the reactorcan be brought safely to cold, subcritical conditions.

When the reactor core is critical or in normal poweroperation, a reactivity balance exists and the netreactivity is zero. A comparison of predicted and measuredreactivity is convenient under such a balance, sinceparameters are being maintained relatively stable understeady state power conditions. The positive reactivityinherent in the core design is balanced by the negativereactivity of the control components, thermal feedback,neutron leakage, and materials in the core that absorbneutrons, such as burnable absorbers, producing zero netreactivity.

In order to achieve the required fuel cycle energy output,the uranium enrichment in the new fuel loading and the fuelloaded in the previous cycles provide excess positivereactivity beyond that required to sustain steady stateoperation at the beginning of cycle (BOC). When the reactoris critical at RTP and operating moderator temperature, theexcess positive reactivity is compensated by burnableabsorbers (e.g., gadolinia), control rods, and whateverneutron poisons (mainly xenon and samarium) are present inthe fuel. The predicted core reactivity, as represented by

(continued)


SDMB 3.1.1

BASES

APPLICABLE SDM has been demonstrated. Prevention or mitigation ofSAFETY ANALYSES reactivity insertion events is necessary to limit energy

(continued) deposition in the fuel to prevent significant fuel damage,which could result in undue release of radioactivity.Adequate SDM ensures inadvertent criticalities and potentialCRDAs involving high worth control rods (namely the firstcontrol rod withdrawn) will not cause significant fueldamage.

SDM satisfies Criterion 2 of the NRC Policy Statement.

LCO The specified SDM limit accounts for the uncertainty in thedemonstration of SDM by testing. Separate SDM limits areprovided for testing where the highest worth control rod isdetermined analytically or by measurement. This is due tothe reduced uncertainty in the SDM test when the highestworth control rod is determined by measurement. When SDM isdemonstrated by calculations not associated with a test(e.g., to confirm SDM during the fuel loading sequence),additional margin is included to account for uncertaintiesin the calculation. To ensure adequate SDM during thedesign process, a design margin is included to account foruncertainties in the design calculations (Ref. 6).

APPLICABILITY In MODES I and 2, SDM must be provided becausesubcriticality with the highest worth control rod withdrawnis assumed in the CRDA analysis (Ref. 2). In MODES 3 and 4,SDM is required to ensure the reactor will be heldsubcritical with margin for a single withdrawn control rod.SDM is required in MODE 5 to prevent an open vessel,inadvertent criticality during the withdrawal of a singlecontrol rod from a core cell containing one or more fuelassemblies (Ref. 4) or a fuel assembly insertion error(Ref. 5).

ACTIONS A.1

With SDM not within the limits of the LCO in MODE I or 2,SDM must be restored within 6 hours. Failure to meet thespecified SDM may be caused by a control rod that cannot beinserted. The allowed Completion Time of 6 hours is

(continued)



BASES


control rod density, is calculated by a 3D core simulatorcode as a function of cycle exposure. This calculation isperformed for projected operating states and conditionsthroughout the cycle. The core reactivity is determinedfrom control rod densities for actual plant conditions andis then compared to the predicted value for the cycleexposure.


Accurate prediction of core reactivity is either an explicitor implicit assumption in the accident analysis evaluations(Ref. 2). In particular, SDM and reactivity transients,such as control rod withdrawal accidents or rod dropaccidents, are very sensitive to accurate prediction of corereactivity. These accident analysis evaluations rely oncomputer codes that have been qualified against availabletest data, operating plant data, and analytical benchmarks.Monitoring reactivity anomaly provides additional assurancethat the nuclear methods provide an accurate representationof the core reactivity.

The comparison between measured and predicted initial corereactivity provides a normalization for the calculationalmodels used to predict core reactivity. If the measured andpredicted rod density for identical core conditions at BOCdo not reasonably agree, then the assumptions used in thereload cycle design analysis or the calculation models usedto predict rod density may not be accurate. If reasonableagreement between measured and predicted core reactivityexists at BOC, then the prediction may be normalized to themeasured value. Thereafter, any significant deviations inthe measured rod density from the predicted rod density thatdevelop during fuel depletion may be an indication that theassumptions of the DBA and transient analyses are no longervalid, or that an unexpected change in core conditions hasoccurred.

Reactivity anomalies satisfy Criterion 2 of the NRC PolicyStatement.

LCO The reactivity anomaly limit is established to ensure plantoperation is maintained within the assumptions of the safetyanalyses. Large differences between monitored and predictedcore reactivity may indicate that the assumptions of the DBAand transient analyses are no longer valid, or that the

(continued)



BASES

LCO uncertainties in the "Nuclear Design Methodology" are larger(continued) than expected. A limit on the difference between the

monitored and the predicted rod density of ± 1% Ak/k hasbeen established based on engineering judgment. A > 1%deviation in reactivity from that predicted is larger thanexpected for normal operation and should therefore beevaluated. A deviation as large as 1% would not exceed thedesign conditions of the reactor and is on the safe side ofthe postulated transients.

APPLICABILITY In MODE 1, most of the control rods are withdrawn and steadystate operation is typically achieved. Under theseconditions, the comparison between predicted and monitoredcore reactivity provides an effective measure of thereactivity anomaly. In MODE 2, control rods are typicallybeing withdrawn during a startup. In MODES 3 and 4, allcontrol rods are fully inserted and therefore the reactor isin the least reactive state, where monitoring corereactivity is not necessary. In MODE 5, fuel loadingresults in a continually changing core reactivity. SDMrequirements (LCO 3.1.1) ensure that fuel movements areperformed within the bounds of the safety analysis, and anSDM demonstration is required during the first startupfollowing operations that could have altered core reactivity(e.g., fuel movement, control rod replacement, shuffling).The SDM test, required by LCO 3.1.1, provides a directcomparison of the predicted and monitored core reactivity atcold conditions; therefore, reactivity anomaly is notrequired during these conditions.

ACTIONS A.]

Should an anomaly develop between measured and predictedcore reactivity, the core reactivity difference must berestored to within the limit to ensure continued operationis within the core design assumptions. Restoration towithin the limit could be performed by an evaluation of thecore design and safety analysis to determine the reason forthe anomaly. This evaluation normally reviews the coreconditions to determine their consistency with input todesign calculations. Measured core and process parametersare also normally evaluated to determine that they arewithin the bounds of the safety analysis, and safetyanalysis calculational models may be reviewed to verify thatthey are adequate for representation of the core conditions.

(continued)



BASES


The required Completion Time of 72 hours is based on the lowprobability of a DBA occurring during this period, andallows sufficient time to assess the physical condition ofthe reactor and complete the evaluation of the core designand safety analysis.

B.1

If the core reactivity cannot be restored to within the1% Ak/k limit, the plant must be brought to a MODE in whichthe LCO does not apply. To achieve this status, the plantmust be brought to at least MODE 3 within 12 hours. Theallowed Completion Time of 12 hours is reasonable, based onoperating experience, to reach MODE 3 from full powerconditions in an orderly manner and without challengingplant systems.


Verifying the reactivity difference between the monitoredand predicted rod density is within the limits of the LCOprovides added assurance that plant operation is maintainedwithin the assumptions of the DBA and transient analyses.The core monitoring system calculates the rod density forthe reactor conditions obtained from plant instrumentation.A comparison of the monitored rod density to the predictedrod density at the same cycle exposure is used to calculatethe reactivity difference. The comparison is required whenthe core reactivity has potentially changed by a significantamount. This may occur following a refueling in which newfuel assemblies are loaded, fuel assemblies are shuffledwithin the core, or control rods are replaced or shuffled.Control rod replacement refers to the decoupling and removalof a control rod from a core location, and subsequentreplacement with a new control rod or a control rod fromanother core location. Also, core reactivity changes duringthe cycle. The 24 hour interval after reaching equilibriumconditions following a startup is based on the need forequilibrium xenon concentrations in the core, such that anaccurate comparison between the monitored and predicted roddensity can be made. For the purposes of this SR, thereactor is assumed to be at equilibrium conditions whensteady state operations (no control rod movement or core

(continued)



BASES

SURVEILLANCEREQUIREMENTS

SR 3.1.2.1 (continued)

flow changes) at ; 75% RTP have been obtained. The1000 MWD/T 'Frequency was developed, considering therelatively slow change in core reactivity with exposure andoperating experience related to variations in corereactivity. The comparison requires the core to beoperating at power levels which minimize the uncertaintiesand measurement errors, in order to obtain meaningfulresults. Therefore, the comparison is only done when inMODE 1.

REFERENCES I. UFSAR, Section 1.5.

2. UFSAR, Chapter 14.


Control Rod OPERABILITYB 3.1.3


B 3.1.3 Control Rod OPERABILITY

BASES

BACKGROUND Control rods are components of the Control Rod Drive (CRD)System, which is the primary reactivity control system forthe reactor. In conjunction with the Reactor ProtectionSystem, the CRD System provides the means for the reliablecontrol of reactivity changes to ensure under conditions ofnormal operation, including abnormal operational transients,that specified acceptable fuel design limits are notexceeded. In addition, the control rods provide thecapability to hold the reactor core subcritical under allconditions and to limit the potential amount and rate ofreactivity increase caused by a malfunction in the CRDSystem. The CRD System is designed to satisfy therequirements specified in Reference 1.

The CRD System consists of 185 locking piston control roddrive mechanisms (CRDMs) and a hydraulic control unit foreach drive mechanism. The locking piston type CRDM is adouble acting hydraulic piston, which uses condensate wateras the operating fluid. Accumulators provide additionalenergy for scram. An index tube and piston, coupled to thecontrol rod, are locked at fixed increments by a colletmechanism. The collet fingers engage notches in the indextube to prevent unintentional withdrawal of the control rod,but without restricting insertion.

This Specification, along with LCO 3.1.4, "Control Rod ScramTimes," and LCO 3.1.5, "Control Rod Scram Accumulators,"ensure that the performance of the control rods in the eventof a Design Basis Accident (DBA) or transient meets theassumptions used in the safety analyses of References 2, 3,and 4.

APPLICABLE The analytical methods and assumptions used in theSAFETY ANALYSES evaluations involving control rods are presented in

References 2, 3, and 4. The control rods provide theprimary means for rapid reactivity control (reactor scram),for maintaining the reactor subcritical and for limiting thepotential effects of reactivity insertion events caused bymalfunctions in the CRD System.

(continued)



BASES


(continued)

The capability to insert the control rods provides assurancethat the assumptions for scram reactivity in the DBA andtransient analyses are not violated. Since the SDM ensuresthe reactor will be subcritical with the highest worthcontrol rod withdrawn (assumed single failure), theadditional failure of a second control rod to insert, ifrequired, could invalidate the demonstrated SDM andpotentially limit the ability of the CRD System to hold thereactor subcritical. If the control rod is stuck at aninserted position and becomes decoupled from the CRD, acontrol rod drop accident (CRDA) can possibly occur.Therefore, the requirement that all control rods be OPERABLEensures the CRD System can perform its intended function.

The control rods also protect the fuel from damage whichcould result in release of radioactivity. The limitsprotected are the MCPR Safety Limit (SL) (see Bases forSL 2.1.1, "Reactor Core SLs" and LCO 3.2.2, "MINIMUMCRITICAL POWER RATIO (MCPR)"), the 1% cladding plasticstrain fuel design limit (see Bases for LCO 3.2.3, "LINEARHEAT GENERATION RATE (LHGR)"), and the fuel damage limit(see Bases for LCO 3.1.6, "Rod Pattern Control") duringreactivity insertion events.

The negative reactivity insertion (scram) provided by theCRD System provides the analytical basis for determinationof plant thermal limits and provides protection against fueldamage limits during a CRDA. The Bases for LCO 3.1.4,LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLsare protected by the CRD System.

Control rod OPERABILITY satisfies Criterion 3 of the NRCPolicy Statement.

LCO The OPERABILITY of an individual control rod is based on acombination of factors, primarily, the scram insertiontimes, the control rod coupling integrity, and the abilityto determine the control rod position. AccumulatorOPERABILITY is addressed by LCO 3.1.5. The associated scramaccumulator status for a control rod only affects the scraminsertion times; therefore, an inoperable accumulator doesnot immediately require declaring a control rod inoperable.Although not all control rods are required to be OPERABLE tosatisfy the intended reactivity control requirements, strict

(continued)



BASES

LCO control over the number and distribution of inoperable(continued) control rods is required to satisfy the assumptions of the

DBA and transient analyses.

APPLICABILITY In MODES I and 2, the control rods are assumed to functionduring a DBA or transient and are therefore required to beOPERABLE in these MODES. In MODES 3 and 4, control rods arenot able to be withdrawn since the reactor mode switch is inshutdown and a control rod block is applied. This providesadequate requirements for control rod OPERABILITY duringthese conditions. Control rod requirements in MODE 5 arelocated in LCO 3.9.5, "Control Rod OPERABILITY-Refueling."

ACTIONS The ACTIONS Table is modified by a Note indicating that aseparate Condition entry is allowed for each control rod.This is acceptable, since the Required Actions for eachCondition provide appropriate compensatory actions for eachinoperable control rod. Complying with the Required Actionsmay allow for continued operation, and subsequent inoperablecontrol rods are governed by subsequent Condition entry andapplication of associated Required Actions.

A.I. A.2, A.3, and A.4

A control rod is considered stuck if it will not insert byeither CRD drive water or scram pressure (i.e., the controlrod cannot be inserted by CRD drive water and cannot beinserted by scram pressure.) With a fully inserted controlrod stuck, only those actions specified in Condition C arerequired as long as the control rod remains fully inserted.The Required Actions are modified by a Note, which allowsthe rod worth minimizer (RWM) to be bypassed if required toallow continued operation. LCO 3.3.2.1, "Control Rod BlockInstrumentation," provides additional requirements when theRWM is bypassed to ensure compliance with the CRDA analysis.With one withdrawn control rod stuck, the local scramreactivity rate assumptions may not be met if the stuckcontrol rod separation criteria are not met. Therefore, averification that the separation criteria are met must beperformed immediately. The separation criteria are not metif a) the stuck control rod occupies a location adjacent totwo "slow" control rods, b) the stuck control rod occupies alocation adjacent to one "slow" control rod, and the one"slow" control rod is also adjacent to another "slow"control rod, or c) if the stuck control rod occupies a

(continued)

PBAPS UNIT 2 B 3.1I-15 Revision No. 2


BASES

ACTIONS A.1. A.2. A.3, and A.4 (continued)

location adjacent to one "slow" control rod when there isanother pair of "slow" control rods adjacent to one another.The description of "slow" control rods is provided inLCO 3.1.4, "Control Rod Scram Times." In addition, theassociated control rod drive must be disarmed in 2 hours.The allowed Completion Time of 2 hours is acceptable,considering the reactor can still be shut down, assuming noadditional control rods fail to insert, and provides areasonable time to perform the Required Action in an orderlymanner. The control rod must be isolated from both scramand normal insert and withdraw pressure. Isolating thecontrol rod from scram and normal insert and withdrawpressure prevents damage to the CRDM. The control rodshould be isolated from scram and normal insert and withdrawpressure, while maintaining cooling water to the CRD.

Monitoring of the insertion capability of each withdrawncontrol rod must also be performed within 24 hours fromdiscovery of Condition A concurrent with THERMAL POWERgreater than the low power setpoint (LPSP) of the RWM.SR 3.1.3.2 and SR 3.1.3.3 perform periodic tests of thecontrol rod insertion capability of withdrawn control rods.Testing each withdrawn control rod ensures that a genericproblem does not exist. This Completion Time also allowsfor an exception to the normal "time zero" for beginning theallowed outage time "clock." The Required Action A.3Completion Time only begins upon discovery of Condition Aconcurrent with THERMAL POWER greater than the actual LPSPof the RWM, since the notch insertions may not be compatiblewith the requirements of rod pattern control (LCO 3.1.6) andthe RWM (LCO 3.3.2.1). The allowed Completion Time of24 hours from discovery of Condition A concurrent withTHERMAL POWER greater than the LPSP of the RWM provides areasonable time to test the control rods, considering thepotential for a need to reduce power to perform the tests.

To allow continued operation with a withdrawn control rodstuck, an evaluation of adequate SDM is also required within72 hours. Should a DBA or transient require a shutdown, topreserve the single failure criterion, an additional controlrod would have to be assumed to fail to insert whenrequired. Therefore, the original SDM demonstration may notbe valid. The SDM must therefore be evaluated (bymeasurement or analysis) with the stuck control rod at its

(continued)



BASES

ACTIONS A.]. A.2. A.3. and A.4 (continued)

stuck position and the highest worth OPERABLE control rodassumed to be fully withdrawn.

The allowed Completion Time of 72 hours to verify SDM isadequate, considering that with a single control rod stuckin a withdrawn position, the remaining OPERABLE control rodsare capable of providing the required scram and shutdownreactivity. Failure to reach MODE 4 is only likely if anadditional control rod adjacent to the stuck control rodalso fails to insert during a required scram. Even with thepostulated additional single failure of an adjacent controlrod to insert, sufficient reactivity control remains toreach and maintain MODE 3 conditions (Ref. 5).

B.1

With two or more withdrawn control rods stuck, the plantmust be brought to MODE 3 within 12 hours. The occurrenceof more than one control rod stuck at a withdrawn positionincreases the probability that the reactor cannot be shutdown if required. Insertion of all insertable control rodseliminates the possibility of an additional failure of acontrol rod to insert. The allowed Completion Time of12 hours is reasonable, based on operating experience, toreach MODE 3 from full power conditions in an orderly mannerand without challenging plant systems.

C.] and C.2

With one or more control rods inoperable for reasons otherthan being stuck in the withdrawn position, (including acontrol rod which is stuck in the fully inserted position)operation may continue, provided the control rods are fullyinserted within 3 hours and disarmed (electrically orhydraulically) within 4 hours. Inserting a control rodensures the shutdown and scram capabilities are notadversely affected. The control rod is disarmed to preventinadvertent withdrawal during subsequent operations. Thecontrol rods can be hydraulically disarmed by closing thedrive water and exhaust water isolation valves. The controlrods can be electrically disarmed by disconnecting powerfrom all four directional control valve solenoids. RequiredAction C.1 is modified by a Note, which allows the RWM to bebypassed if required to allow insertion of the inoperable

(continued)



BASES

ACTIONS C.1 and C.2 (continued)

control rods and continued operation. LCO 3.3.2.1 providesadditional requirements when the RWM is bypassed to ensurecompliance with the CRDA analysis.

The allowed Completion Times are reasonable, considering thesmall number of allowed inoperable control rods, and providetime to insert and disarm the control rods in an orderlymanner and without challenging plant systems.

D.I and D.2

Out of sequence control rods may increase the potentialreactivity worth of a dropped control rod during a CRDA. At- 10% RTP, the generic banked position withdrawal sequence(BPWS) analysis (Ref. 5) requires inserted control rods notin compliance with BPWS to be separated by at least twoOPERABLE control rods in all directions, including thediagonal. Therefore, if two or more inoperable control rodsare not in compliance with BPWS and not separated by atleast two OPERABLE control rods, action must be taken torestore compliance with BPWS or restore the control rods toOPERABLE status. Condition D is modified by a Noteindicating that the Condition is not applicable when> 10% RTP, since the BPWS is not required to be followedunder these conditions, as described in the Bases forLCO 3.1.6. The allowed Completion Time of 4 hours isacceptable, considering the low probability of a CRDAoccurring.

E.1

If any Required Action and associated Completion Time ofCondition A, C, or D are not met, or there are nine or moreinoperable control rods, the plant must be brought to a MODEin which the LCO does not apply. To achieve this status,the plant must be brought to MODE 3 within 12 hours. Thisensures all insertable control rods are inserted and placesthe reactor in a condition that does not require the activefunction (i.e., scram) of the control rods. The number ofcontrol rods permitted to be inoperable when operating above10% RTP (e.g., no CRDA considerations) could be more thanthe value specified, but the occurrence of a large number of

(continued)



BASES

ACTIONS E.] (continued)

inoperable control rods could be indicative of a genericproblem, and investigation and resolution of the potentialproblem should be undertaken. The allowed Completion Timeof 12 hours is reasonable, based on operating experience, toreach MODE 3 from full power in an orderly manner andwithout challenging plant systems.


The position of each control rod must be determined toensure adequate information on control rod position isavailable to the operator for determining control rodOPERABILITY and controlling rod patterns. Control rodposition may be determined by the use of OPERABLE positionindicators, by moving control rods to a position with anOPERABLE indicator, or by the use of other appropriatemethods. The 24 hour Frequency of this SR is based onoperating experience related to expected changes in controlrod position and the availability of control rod positionindications in the control room.

SR 3.1.3.2 and SR 3.1.3.3

Control rod insertion capability is demonstrated byinserting each partially or fully withdrawn control rod atleast one notch and observing that the control rod moves.The control rod may then be returned to its originalposition. This ensures the control rod is not stuck and isfree to insert on a scram signal. These Surveillances arenot required when THERMAL POWER is less than or equal to theactual LPSP of the RWM, since the notch insertions may notbe compatible with the requirements of the Banked PositionWithdrawal Sequence (BPWS) (LCO 3.1.6) and the RWM(LCO 3.3.2.1). The 7 day Frequency of SR 3.1.3.2 is basedon operating experience related to the changes in CRDperformance and the ease of performing notch testing forfully withdrawn control rods. Partially withdrawn controlrods are tested at a 31 day Frequency, based on thepotential power reduction required to allow the control rodmovement and considering the large testing sample ofSR 3.1.3.2. Furthermore, the 31 day Frequency takes intoaccount operating experience related to changes in CRDperformance. At any time, if a control rod is immovable, a

(continued)



BASES

SURVEILLANCE SR 3.1.3.2 and SR 3.1.3.3 (continued)REQUIREMENTS

determination of that control rod's trippability(OPERABILITY) must be made and appropriate action taken.For example, the unavailability of the Reactor ManualControl System does not affect the OPERABILITY of thecontrol rods, provided SR 3.1.3.2 and SR 3.1.3.3 are currentin accordance with SR 3.0.2.

SR 3.1.3.4

Verifying that the scram time for each control rod to notchposition 06 is s 7 seconds provides reasonable assurancethat the control rod will insert when required during a DBAor transient, thereby completing its shutdown function.This SR is performed in conjunction with the control rodscram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3,and SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST inLCO 3.3.1.1, "Reactor Protection System (RPS)Instrumentation," and the functional testing of SDV vent anddrain valves in LCO 3.1.8, "Scram Discharge Volume (SDV)Vent and Drain Valves," overlap this Surveillance to providecomplete testing of the assumed safety function. Theassociated Frequencies are acceptable, considering the morefrequent testing performed to demonstrate other aspects ofcontrol rod OPERABILITY and operating experience, whichshows scram times do not significantly change over anoperating cycle.

SR 3.1.3.5

Coupling verification is performed to ensure the control rodis connected to the CRDM and will perform its intendedfunction when necessary. The Surveillance requiresverifying a control rod does not go to the withdrawnovertravel position. The overtravel position featureprovides a positive check on the coupling integrity sinceonly an uncoupled CRD can reach the overtravel position.The verification is required to be performed any time acontrol rod is withdrawn to the "full out" position (notchposition 48) or prior to declaring the control rod OPERABLEafter work on the control rod or CRD System that couldaffect coupling (CRD changeout and blade replacement orcomplete cell disassembly, i.e., guide tube removal). Thisincludes control rods inserted one notch and then returned

(continued).

PBAPS UNIT 2 B 3.1]-20 Revision No. 0


BASES


to the "full out" position during the performance ofSR 3.1.3.2. This Frequency is acceptable, considering thelow probability that a control rod will become uncoupledwhen it is not being moved and operating experience relatedto uncoupling events.

REFERENCES 1. UFSAR, Sections 1.5.1.1 and 1.5.2.2.


3. UFSAR, Appendix K, Section VI.


5. NEDO-21231, "Banked Position Withdrawal Sequence,"Section 7.2, January 1977.


Control Rod Scram TimesB 3.1.4


B 3.1.4 Control Rod Scram Times

BASES

BACKGROUND The scram function of the Control Rod Drive (CRD) Systemcontrols reactivity changes during abnormal operationaltransients to ensure that specified acceptable fuel designlimits are not exceeded (Ref. 1). The control rods arescrammed by positive means using hydraulic pressure exertedon the CRD piston.

When a scram signal is initiated, control air is vented fromthe scram valves, allowing them to open by spring action.Opening the exhaust valve reduces the pressure above themain drive piston to atmospheric pressure, and opening theinlet valve applies the accumulator or reactor pressure tothe bottom of the piston. Since the notches in the indextube are tapered on the lower edge, the collet fingers areforced open by cam action, allowing the index tube to moveupward without restriction because of the high differentialpressure across the piston. As the drive moves upward andthe accumulator pressure reduces below the reactor pressure,a ball check valve opens, letting the reactor pressurecomplete the scram action. If the reactor pressure is low,such as during startup, the accumulator will fully insertthe control rod in the required time without assistance fromreactor pressure.


The analytical methods and assumptions used in evaluatingthe control rod scram function are presented inReferences 2, 3, and 4. The Design Basis Accident (DBA) andtransient analyses assume that all of the control rods scramat a specified insertion rate. The resulting negative scramreactivity forms the basis for the determination of plantthermal limits (e.g., the MCPR). Other distributions ofscram times (e.g., several control rods scramming slowerthan the average time with several control rods scrammingfaster than the average time) can also provide sufficientscram reactivity. Surveillance of each individual controlrod's scram time ensures the scram reactivity assumed in theDBA and transient analyses can be met.

(continued)



BASES


(continued)

The scram function of the CRD System protects the MCPRSafety Limit (SL) (see Bases for SL 2.1.1, "Reactor CoreSLs" and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)")and the 1% cladding plastic strain fuel design limit (seeBases for LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"),which ensure that no fuel damage will occur if these limitsare not exceeded. Above 800 psig, the scram function isdesigned to insert negative reactivity at a rate fast enoughto prevent the actual MCPR from becoming less than the MCPRSL, during the analyzed limiting power transient. Below800 psig, the scram function is assumed to perform duringthe control rod drop accident (Ref. 5) and, therefore, alsoprovides protection against violating fuel damage limitsduring reactivity insertion accidents (see Bases forLCO 3.1.6, "Rod Pattern Control"). For the reactor vesseloverpressure protection analysis, the scram function, alongwith the safety/relief valves, ensure that the peak vesselpressure is maintained within the applicable ASME Codelimits.

Control rod scram times satisfy Criterion 3 of the NRCPolicy Statement.

LCO The scram times specified in Table 3.1.4-1 (in theaccompanying LCO) are required to ensure that the scramreactivity assumed in the DBA and transient analysis is met(Ref. 6).

To account for single failures and "slow" scramming controlrods, the scram times specified in Table 3.1.4-1 are fasterthan those assumed in the design basis analysis. The scramtimes have a margin that allows up to approximately 7% ofthe control rods (e.g., 185 x 7% : 13) to have scram timesexceeding the specified limits (i.e., "slow" control rods)assuming a single stuck control rod (as allowed byLCO 3.1.3, "Control Rod OPERABILITY") and an additionalcontrol rod failing to scram per the single failurecriterion. The scram times are specified as a function ofreactor steam dome pressure to account for the pressuredependence of the scram times. The scram times arespecified relative to measurements based on reed switchpositions, which provide the control rod positionindication. The reed switch closes ("pickup") when the

(continued)



BASES

LCO(continued)

index tube passes a specific location and then opens("dropout") as the index tube travels upward. Verificationof the specified scram times in Table 3.1.4-1 isaccomplished through measurement of the "dropout" times.

To ensure that local scram reactivity rates are maintainedwithin acceptable limits, no more than two of the allowed"slow" control rods may occupy adjacent locations.

Table 3.1.4-1 is modified by two Notes, which state thatcontrol rods with scram times not within the limits of thetable are considered "slow" and that control rods with scramtimes > 7 seconds are considered inoperable as required bySR 3.1.3.4.

This LCO applies only to OPERABLE control rods sinceinoperable control rods will be inserted and disarmed(LCO 3.1.3). Slow scramming control rods may beconservatively declared inoperable and not accounted for as"slow" control rods.

APPLICABILITY In MODES 1 and 2, a scram is assumed to function duringtransients and accidents analyzed for these plantconditions. These events are assumed to occur duringstartup and power operation; therefore, the scram functionof the control rods is required during these MODES. InMODES 3 and 4, the control rods are not able to be withdrawnsince the reactor mode switch is in shutdown and a controlrod block is applied. This provides adequate requirementsfor control rod scram capability during these conditions.Scram requirements in MODE 5 are contained in LCO 3.9.5,"Control Rod OPERABILITY-Refueling."

ACTIONS A.]I

When the requirements of this LCO are not met, the rate ofnegative reactivity insertion during a scram may not bewithin the assumptions of the safety analyses. Therefore,the plant must be brought to a MODE in which the LCO doesnot apply. To achieve this status, the plant must bebrought to MODE 3 within 12 hours. The allowed CompletionTime of 12 hours is reasonable, based on operatingexperience, to reach MODE 3 from full power conditions in anorderly manner and without challenging plant systems.

(continued)



BASES (continued)

SURVEILLANCE The four SRs of this LCO are modified by a Note stating thatREQUIREMENTS during a single control rod scram time surveillance, the CRD

pumps shall be isolated from the associated scramaccumulator. With the CRD pump isolated, (i.e., chargingvalve closed) the influence of the CRD pump head does notaffect the single control rod scram times. During a fullcore scram, the CRD pump head would be seen by all controlrods and would have a negligible effect on the scraminsertion times.

SR 3.1.4.1

The scram reactivity used in DBA and transient analyses isbased on an assumed control rod scram time. Measurement ofthe scram times with reactor steam dome pressure Ž 800 psigdemonstrates acceptable scram times for the transientsanalyzed in References 3 and 4.

Maximum scram insertion times occur at a reactor steam domepressure of approximately 800 psig because of the competingeffects of reactor steam dome pressure and storedaccumulator energy. Therefore, demonstration of adequatescram times at reactor steam dome pressure Ž 800 psigensures that the measured scram times will be within thespecified limits at higher pressures. Limits are specifiedas a function of reactor pressure to account for thesensitivity of the scram insertion times with pressure andto allow a range of pressures over which scram time testingcan be performed. To ensure that scram time testing isperformed within a reasonable time after a shutdownŽ 120 days or longer, all control rods are required to betested before exceeding 40% RTP. This Frequency isacceptable considering the additional surveillancesperformed for control rod OPERABILITY, the frequentverification of adequate accumulator pressure, and therequired testing of control rods affected by fuel movementwithin the associate core cell and by work on control rodsor the CRD System.

SR 3.1.4.2

Additional testing of a sample of control rods is requiredto verify the continued performance of the scram functionduring the cycle. A representative sample contains at least10% of the control rods. The sample remains representative

(continued)



BASES


if no more than 20% of the control rods in the sample testedare determined to be "slow". With more than 20% of thesample declared to be "slow" per the criteria inTable 3.1.4-1, additional control rods are tested until this20% criterion (i.e., 20% of the active sample size) issatisfied, or until the total number of "slow" control rods(throughout the core, from all Surveillances) exceeds theLCO limit. For planned testing, the control rods selectedfor the sample should be different for each test. Data frominadvertent scrams should be used whenever possible to avoidunnecessary testing at power, even if the control rods withdata may have been previously tested in a sample. The120 day Frequency is based on operating experience that hasshown control rod scram times do not significantly changeover an operating cycle. This Frequency is also reasonablebased on the additional Surveillances done on the CRDs atmore frequent intervals in accordance with LCO 3.1.3 andLCO 3.1.5, "Control Rod Scram Accumulators."

SR 3.1.4.3

When work that could affect the scram insertion time isperformed on a control rod or the CRD System, testing mustbe done to demonstrate that each affected control rodretains adequate scram performance over the range ofapplicable reactor pressures from zero to the maximumpermissible pressure. This surveillance can be met byperformance of either scram time testing or DiaphragmAlternative Response Time (DART) testing, when it isconcluded that DART testing monitors the performance of allaffected components. The testing must be performed oncebefore declaring the control rod OPERABLE. The requiredtesting must demonstrate the affected control rod is stillwithin acceptable limits. The limits for reactor pressures< 800 psig are established based on a high probability ofmeeting the acceptance criteria at reactor pressures ; 800psig. Limits for Ž 800 psig are found in Table 3.1.4-1. Iftesting demonstrates the affected control rod does not meetthese limits, but is within the 7 second limit of Table3.1.4-1, Note 2, the control rod can be declared OPERABLEand "slow."

(cnntinued)



BASES


Specific examples of work that could affect the scram timesare (but are not limited to) the following: removal of anyCRD for maintenance or modification; replacement of acontrol rod; and maintenance or modification of a scramsolenoid pilot valve, scram valve, accumulator, isolationvalve or check valve in the piping required for scram.

The Frequency of once prior to declaring the affectedcontrol rod OPERABLE is acceptable because of the capabilityto test the control rod over a range of operating conditionsand the more frequent surveillances on other aspects ofcontrol rod OPERABILITY.

SR 3.1.4.4

When work that could affect the scram insertion time isperformed on a control rod or CRD System, or when fuelmovement within the reactor vessel occurs testing must bedone to demonstrate each affected control rod is stillwithin the limits of Table 3.1.4-1 with the reactor steamdome pressure Ž 800 psig. Where work has been performed athigh reactor pressure, the requirements of SR 3.1.4.3 andSR 3.1.4.4 can be satisfied with one test. For a controlrod affected by work performed while shut down, however, azero pressure and high pressure test may be required. Thistesting ensures that, prior to withdrawing the control rodfor continued operation, the control rod scram performanceis acceptable for operating reactor pressure conditions.Alternatively, a control rod scram test during hydrostaticpressure testing could also satisfy both criteria. Whenfuel movement occurs within the reactor pressure vessel,only those control rods associated with the core cellsaffected by the fuel movement are required to be scram timetested. During a routine refueling outage, it is expectedthat all control rods will be affected.

The Frequency of once prior to exceeding 40% RTP isacceptable because of the capability to test the control rodover a range of operating conditions and the more frequentsurveillances on other aspects of control rod OPERABILITY.

REFERENCES 1. UFSAR, Sections 1.5.1.3 and 1.5.2.2.


(continued)

PBAPS UNIT 2 8 3.1-27 Revision No. 57


BASES

REFERENCES 3. UFSAR, Appendix K, Section VI.(continued)


5. NEDE-24011-P-A-1O, "General Electric StandardApplication for Reactor Fuel," Section 3.2.4.1,February 1991.

6. Letter from R. E. Janecek (BWROG) to R. W. Starostecki(NRC), "BWR Owners Group Revised Reactivity ControlSystem Technical Specifications," BWROG-8754,September 17, 1987.

0


Control Rod Scram AccumulatorsB 3.1.5


B 3.1.5 Control Rod Scram Accumulators

BASES

BACKGROUND The control rod scram accumulators are part of the ControlRod Drive (CRD) System and are provided to ensure that thecontrol rods scram under varying reactor conditions. Thecontrol rod scram accumulators store sufficient energy tofully insert a control rod at any reactor vessel pressure.The accumulator is a hydraulic cylinder with a free floatingpiston. The piston separates the water used to scram thecontrol rods from the nitrogen, which provides the requiredenergy. The scram accumulators are necessary to scram thecontrol rods within the required insertion times ofLCO 3.1.4, "Control Rod Scram Times."


The analytical methods and assumptions used in evaluatingthe control rod scram function are presented inReferences 1, 2, and 3. The Design Basis Accident (DBA) andtransient analyses assume that all of the control rods scramat a specified insertion rate. OPERABILITY of eachindividual control rod scram accumulator, along withLCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.4, ensuresthat the scram reactivity assumed in the DBA and transientanalyses can be met. The existence of an inoperableaccumulator may invalidate prior scram time measurements forthe associated control rod.

The scram function of the CRD System, and therefore theOPERABILITY of the accumulators, protects the MCPR SafetyLimit (see Bases for SL 2.1.1, "Reactor Core SLs" andLCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and1% cladding plastic strain fuel design limit (see Bases forLCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), whichensure that no fuel damage will occur if these limits are notexceeded (see Bases for LCO 3.1.4). In addition, the scramfunction at low reactor vessel pressure (i.e., startupconditions) provides protection against violating fuel designlimits during reactivity insertion accidents (see Bases forLCO 3.1.6, "Rod Pattern Control").

Control rod scram accumulators satisfy Criterion 3 of theNRC Policy Statement.

(continued)



BASES (continued)

LCO The OPERABILITY of the control rod scram accumulators isrequired to ensure that adequate scram insertion capabilityexists when needed over the entire range of reactorpressures. The OPERABILITY of the scram accumulators isbased on maintaining adequate accumulator pressure.

APPLICABILITY In MODES I and 2, the scram function is required formitigation of DBAs and transients, and therefore the scramaccumulators must be OPERABLE to support the scram function.In MODES 3 and 4, control rods are not able to be withdrawnsince the reactor mode switch is in shutdown and a. controlrod block is applied. This provides adequate requirementsfor control rod scram accumulator OPERABILITY during theseconditions. Requirements for scram accumulators in MODE 5are contained in LCO 3.9.5, "Control RodOPERABILITY-Refueling."

ACTIONS The ACTIONS Table is modified by a Note indicating that aseparate Condition entry is allowed for each control rodscram accumulator. This is acceptable since the RequiredActions for each Condition provide appropriate compensatoryactions for each inoperable accumulator. Complying with theRequired Actions may allow for continued operation andsubsequent inoperable accumulators governed by subsequentCondition entry and application of associated RequiredActions.

A.] and A.2

With one control rod scram accumulator inoperable and thereactor steam dome pressure ; 900 psig, the control rod maybe declared "slow," since the control rod will still scramat the reactor operating pressure but may not satisfy therequired scram times in Table 3.1.4-1. Required Action A.1is modified by a Note indicating that declaring the controlrod "slow" only applies if the associated control scram timewas within the limits of Table 3.1.4-1 during the last scramtime test. Otherwise, the control rod would already beconsidered "slow" and the further degradation of scramperformance with an inoperable accumulator could result inexcessive scram times. In this event, the associated

(continued)



BASES

ACTIONS A.1 and A.2 (continued)

control rod is declared inoperable (Required Action A.2) andLCO 3.1.3 is entered. This would result in requiring theaffected control rod to be fully inserted and disarmed,thereby satisfying its intended function, in accordance withACTIONS of LCO 3.1.3.

The allowed Completion Time of 8 hours is reasonable, basedon the large number of control rods available to provide thescram function and the ability of the affected control rodto scram only with reactor pressure at high reactorpressures.

B.I. B.2.1. and B.2.2

With two or more control rod scram accumulators inoperableand reactor steam dome pressure 2 900 psig, adequatepressure must be supplied to the charging water header.With inadequate charging water pressure, all of theaccumulators could become inoperable, resulting in apotentially severe degradation of the scram performance.Therefore, within 20 minutes from discovery of chargingwater header pressure < 940 psig concurrent withCondition B, adequate charging water header pressure must berestored. The allowed Completion Time of 20 minutes isreasonable, to place a CRD pump into service to restore thecharging water header pressure, if required. ThisCompletion Time is based on the ability of the reactorpressure alone to fully insert all control rods.

The control rod may be declared "slow," since the controlrod will still scram using only reactor pressure, but maynot satisfy the times in Table 3.1.4-1. RequiredAction B.2.1 is modified by a Note indicating that declaringthe control rod "slow" only applies if the associatedcontrol scram time is within the limits of Table 3.1.4-1during the last scram time test. Otherwise, the control rodwould already be considered "slow" and the furtherdegradation of scram performance with an inoperableaccumulator could result in excessive scram times. In thisevent, the associated control rod is declared inoperable(Required Action B.2.2) and LCO 3.1.3 entered. This would

(continued)



BASES

ACTIONS B.I. B.2.1. and B.2.2 (continued)

result in requiring the affected control rod to be fullyinserted and disarmed, thereby satisfying its intendedfunction in accordance with ACTIONS of LCO 3.1.3.

The allowed Completion Time of I hour is reasonable, basedon the ability of only the reactor pressure to scram thecontrol rods and the low probability of a DBA or transientoccurring while the affected accumulators are inoperable.

C.1 and C.2

With one or more control rod scram accumulators inoperableand the reactor steam dome pressure < 900 psig, the pressuresupplied to the charging water header must be adequate toensure that accumulators remain charged. With the reactorsteam dome pressure < 900 psig, the function of theaccumulators in providing the scram force becomes much moreimportant since the scram function could become severelydegraded during a depressurization event or at low reactorpressures. Therefore, immediately upon discovery ofcharging water header pressure < 940 psig, concurrent withCondition C, all control rods associated with inoperableaccumulators must be verified to be fully inserted.Withdrawn control rods with inoperable accumulators may failto scram under these low pressure conditions. Theassociated control rods must also be declared inoperablewithin 1 hour. The allowed Completion Time of 1 hour isreasonable for Required Action C.2, considering the lowprobability of a DBA or transient occurring during the timethat the accumulator is inoperable.

D.1

The reactor mode switch must be immediately placed in theshutdown position if either Required Action and associatedCompletion Time associated with the loss of the CRD chargingpump (Required Actions B.1 and C.1) cannot be met. Thisensures that all insertable control rods are inserted andthat the reactor is in a condition that does not require the

(continuedl



BASES

ACTIONS D.1 (continued)

active function (i.e., scram) of the control rods. ThisRequired Action is modified by a Note stating that theaction is not applicable if all control rods associated withthe inoperable scram accumulators are fully inserted, sincethe function of the control rods has been performed.


SR 3.1.5.1 requires that the accumulator pressure be checkedevery 7 days to ensure adequate accumulator pressure existsto provide sufficient scram force. The primary indicator ofaccumulator OPERABILITY is the accumulator pressure. Aminimum accumulator pressure is specified, below which thecapability of the accumulator to perform its intendedfunction becomes degraded and the accumulator is consideredinoperable. The minimum accumulator pressure of 940 psig iswell below the expected pressure of approximately 1450 psig(Ref. 1). Declaring the accumulator inoperable when theminimum pressure is not maintained ensures that significantdegradation in scram times does not occur. The 7 dayFrequency has been shown to be acceptable through operatingexperience and takes into account indications available inthe control room.

REFERENCES 1. UFSAR, Section 3.4.5.3 and Figure 3.4.10.

2. UFSAR, Appendix K, Section VI.


I


Rod Pattern ControlB 3.1.6


B 3.1.6 Rod Pattern Control

BASES

BACKGROUND Control rod patterns during startup conditions arecontrolled by the operator and the rod worth minimizer (RWM)(LCO 3.3.2.1, "Control Rod Block Instrumentation"), so thatonly specified control rod sequences and relative positionsare allowed over the operating range of all control rodsinserted to 10% RTP. The sequences limit the potentialamount of reactivity addition that could occur in the eventof a Control Rod Drop Accident (CRDA).

This Specification assures that the control rod patterns areconsistent with the assumptions of the CRDA analyses ofReferences 1 and 2.


The analytical methods and assumptions used in evaluatingthe CRDA are summarized in References 1 and 2. CRDAanalyses assume that the reactor operator follows prescribedwithdrawal sequences. These sequences define the potentialinitial conditions for the CRDA analysis. The RWM(LCO 3.3.2.1) provides backup to operator control of thewithdrawal sequences to ensure that the initial conditionsof the CRDA analysis are not violated.

Prevention or mitigation of positive reactivity insertionevents is necessary to limit the energy deposition in thefuel, thereby preventing significant fuel damage which couldresult in the undue release of radioactivity. Since thefailure consequences for U02 have been shown to beinsignificant below fuel energy depositions of 300 cal/gm(Ref. 3), the fuel damage limit of 280 cal/gm provides amargin of safety from significant core damage which wouldresult in release of radioactivity (Refs. 4 and 5). Genericevaluations (Refs. I and 6) of a design basis CRDA (i.e., aCRDA resulting in a peak fuel energy deposition of280 cal/gm) have shown that if the peak fuel enthalpyremains below 280 cal/gm, then the maximum reactor pressurewill be less than the required ASME Code limits (Ref. 7) andthe calculated offsite doses will be well within therequired limits (Ref. 5).

(continued)



BASES


(continued)

Control rod patterns analyzed in Reference I follow thebanked position withdrawal sequence (BPWS). The BPWS isapplicable from the condition of all control rods fullyinserted to 10% RTP (Ref. 2). For the BPWS, the controlrods are required to be moved in groups, with all controlrods assigned to a specific group required to be withinspecified banked positions (e.g., between notches 08and 12). The banked positions are established to minimizethe maximum incremental control rod worth without beingoverly restrictive during normal plant operation. Genericanalysis of the BPWS (Ref. 1) has demonstrated that the280 cal/gm fuel damage limit will not be violated during aCRDA while following the BPWS mode of operation. Thegeneric BPWS analysis (Ref. 8) also evaluates the effect offully inserted, inoperable control rods not in compliancewith the sequence, to allow a limited number (i.e., eight)and distribution of fully inserted, inoperable control rods.

Rod pattern control satisfies Criterion 3 of the NRC PolicyStatement.

LCO Compliance with the prescribed control rod sequencesminimizes the potential consequences of a CRDA by limitingthe initial conditions to those consistent with the BPWS.This LCO only applies to OPERABLE control rods. Forinoperable control rods required to be inserted, separaterequirements are specified in LCO 3.1.3, "Control RodOPERABILITY," consistent with the allowances for inoperablecontrol rods in the BPWS.

APPLICABILITY In MODES 1 and 2, when THERMAL POWER is 5 10% RTP, the CRDAis a Design Basis Accident and, therefore, compliance withthe assumptions of the safety analysis is required. WhenTHERMAL POWER is > 10% RTP, there is no credible control rodconfiguration that results in a control rod worth that couldexceed the 280 cal/gm fuel damage limit during a CRDA(Ref. 2). In MODES 3, 4, and 5, since the reactor is shutdown and only a single control rod can be withdrawn from acore cell containing fuel assemblies, adequate SDM ensuresthat the consequences of a CRDA are acceptable, since thereactor will remain subcritical with a single control rodwithdrawn.

(continued)



BASES (continued)

ACTIONS A.1 and A.2

With one or more OPERABLE control rods not in compliancewith the prescribed control rod sequence, actions may betaken to either correct the control rod pattern or declarethe associated control rods inoperable within 8 hours.Noncompliance with the prescribed sequence may be the resultof "double notching," drifting from a control rod drivecooling water transient, leaking scram valves, or a powerreduction to 5 10% RTP before establishing the correctcontrol rod pattern. The number of OPERABLE control rodsnot in compliance with the prescribed sequence is limited toeight, to prevent the operator from attempting to correct acontrol rod pattern that significantly deviates from theprescribed sequence. When the control rod pattern is not incompliance with the prescribed sequence, all control rodmovement must be stopped except for moves needed to correctthe rod pattern, or scram if warranted.

Required Action A.1 is modified by a Note which allows theRWM to be bypassed to allow the affected control rods to bereturned to their correct position. LCO 3.3.2.1 requiresverification of control rod movement by a second licensedoperator or a qualified member of the technical staff (i.e.,personnel trained in accordance with an approved trainingprogram). This ensures that the control rods will be movedto the correct position. A control rod not in compliancewith the prescribed sequence is not considered inoperableexcept as required by Required Action A.2. The allowedCompletion Time of 8 hours is reasonable, considering therestrictions on the number of allowed out of sequencecontrol rods and the low probability of a CRDA occurringduring the time the control rods are out of sequence.

B.] and B.2

If nine or more OPERABLE control rods are out of sequence,the control rod pattern significantly deviates from theprescribed sequence. Control rod withdrawal should besuspended immediately to prevent the potential for furtherdeviation from the prescribed sequence. Control rodinsertion to correct control rods withdrawn beyond theirallowed position is allowed since, in general, insertion of

(continued)



BASES

ACTIONS B.1 and B.2 (continued)

control rods has less impact on control rod worth thanwithdrawals have. Required Action B.1 is modified by a Notewhich allows the RWM to be bypassed to allow the affectedcontrol rods to be returned to their correct position.

LCO 3.3.2.1 requires verification of control rod movement bya second licensed operator or a qualified member of thetechnical staff.

When nine or more OPERABLE control rods are not incompliance with BPWS, the reactor mode switch must be placedin the shutdown position within I hour. With the modeswitch in shutdown, the reactor is shut down, and as such,does not meet the applicability requirements of this LCO.The allowed Completion Time of I hour is reasonable to allowinsertion of control rods to restore compliance, and isappropriate relative to the low probability of a CRDAoccurring with the control rods out of sequence.

SURVEILLANCE SR 3.1.6.]REQUIREMENTS

The control rod pattern is verified to be in compliance withthe BPWS at a 24 hour Frequency to ensure the assumptions ofthe CRDA analyses are met. The 24 hour Frequency wasdeveloped considering that the primary check on compliancewith the BPWS is performed by the RWM (LCO 3.3.2.1), whichprovides control rod blocks to enforce the required sequenceand is required to be OPERABLE when operating at 5 10% RTP.

REFERENCES - 1. NEDE-24011-P-A-10-US, "General Electric StandardApplication for Reactor Fuel, Supplement for UnitedStates," Section 2.2.3.1, February 1991.

2. Letter (BWROG-8644) from T. Pickens (BWROG) to G. C.Lainas (NRC), "Amendment 17 to General ElectricLicensing Topical Report NEDE-24011-P-A."


4. NUREG-0800, Section 15.4.9, Revision 2, July 1981.

5. 10 CFR 100.11.

(continued)

PBAPS UNIT 2 B 3.1]-37 Revision No. 0


BASES

REFERENCES 6. NEDO-21778-A, "Transient Pressure Rises Affected(continued) Fracture Toughness Requirements for Boiling Water

Reactors," December 1978.

7. ASME, Boiler and Pressure Vessel Code.

8. NEDO-21231, "Banked Position Withdrawal Sequence,"January 1977.


SLC SystemB 3.1.7


1 3.1.7 Standby Liquid Control (SLC) System

BASES

BACKGROUND The SLC System is designed to provide the capability ofbringing the reactor, at any time in a fuel cycle, from fullpower and minimum control rod inventory (which is at thepeak of the xenon transient) to a subcritical condition withthe reactor in the most reactive, xenon free state withouttaking credit for control rod movement. The SLC Systemsatisfies the requirements of 10 CFR 50.62 (Ref. 1) onanticipated transient without scram using enriched boron.

Reference I requires a SLC System with a minimum flowcapacity and boron content equivalent in control capacity to86 gpm of 13 weight percent sodium pentaborate solution.Natural sodium pentaborate solution is 19.8% atom Boron-t0.Therefore, the system parameters of concern, boronconcentration (C), SLC pump flow rate (Q), and Boron-t0enrichment (E), may be expressed as a multiple of ratios.The expression is as follows:

C Q Ex x

13% weight 86 gpm 19.8% atom

If the product of this expression is ; 1, then the SLCSystem satisfies the criteria of Reference 1. As such, theequation forms the basis for acceptance criteria for thesurveillances of concentration, flow rate, and boronenrichment and is presented in Table 3.1.7-1.

The SLC System consists of a boron solution storage tank,two positive displacement pumps, two explosive valves thatare provided in parallel for redundancy, and associatedpiping and valves used to transfer borated water from thestorage tank to the reactor pressure vessel (RPV). Theborated solution is discharged near the bottom of the coreshroud, where it then mixes with the cooling water risingthrough the core. A smaller tank containing demineralizedwater is provided for testing purposes.

(continued)

PBAPS, UNIT 2 B 3.1-39 Revision No. 0

SLC SystemB 3.1.7

BASES (continued)


The SLC System is manually initiated from the main controlroom, as directed by the emergency operating procedures, ifthe operator believes the reactor cannot be shut down, orkept shut down, with the control rods. The SLC System isused in the event that enough control rods cannot beinserted to accomplish shutdown and cooldown in the normalmanner. The SLC System injects borated water into thereactor core to add negative reactivity to compensate forall of the various reactivity effects that could occurduring plant operations. To meet this objective, it isnecessary to inject a quantity of boron, which produces aconcentration of 660 ppm of natural boron, in the reactorcoolant at 68"F. To allow for potential leakage andimperfect mixing in the reactor system, an additional amountof boron equal to 25% of the amount cited above is added(Ref. 2). The minimum mass of Boron-l0 (162.7 Ibm) neededfor injection is calculated such that the required quantityis achieved accounting for dilution in the RPV with normalwater level and including the water volume in the residualheat removal shutdown cooling piping and in therecirculation loop piping. This quantity of boratedsolution is the amount that is above the pump suctionshutoff level in the boron solution storage tank. No creditis taken for the portion of the tank volume that cannot beinjected. The maximum concentration of sodium pentaboratelisted in Table 3.1.7-1 has been established to ensure thatthe solution saturation temperature does not exceed 43"F.

The SLC System satisfies Criterion 4 of the NRC PolicyStatement.

LCO The OPERABILITY of the SLC System provides backup capabilityfor reactivity control independent of normal reactivitycontrol provisions provided by the control rods. TheOPERABILITY of the SLC System is based on the conditions ofthe borated solution in the storage tank and theavailability of a flow path to the RPV, including theOPERABILITY of the pumps and valves. Two SLC subsystems arerequired to be OPERABLE; each contains an OPERABLE pump, anexplosive valve, and associated piping, valves, andinstruments and controls to ensure an OPERABLE flow path.

(continued)


SLC SystemB 3.1.7

BASES (continued)

APPLICABILITY In MODES I and 2, shutdown capability is required. InMODES 3 and 4, control rods are not able to be withdrawnsince the reactor mode switch is in shutdown and a controlrod block is applied. This provides adequate controls toensure that the reactor remains subcritical. In MODE 5,only a single control rod can be withdrawn from a core cellcontaining fuel assemblies. Demonstration of adequate SDM(LCO 3.1.1, 'SHUTDOWN MARGIN (SDM)P) ensures that thereactor will not become critical. Therefore, the SLC Systemis not required to be OPERABLE when only a single controlrod can be withdrawn.

ACTIONS A.1 and A.2

If the boron solution concentration is > 9.82% weight butthe concentration and temperature of boron in solution andpump suction piping temperature are within the limits ofFigure 3.1.7-1, operation is permitted for a limited periodsince the SLC subsystems are capable of performing theintended function. It is not necessary under theseconditions to declare both SLC subsystems inoperable sincethe SLC subsystems are capable of performing their intendedfunction.

The concentration and temperature of boron in solution andpump suction piping temperature must be verified to bewithin the limits of Figure 3.1.7-1 within 8 hours and onceper 12 hours thereafter (Required Action A.1). Thetemperature versus concentration curve of Figure 3.1.7-1ensures a 10OF margin will be maintained above thesaturation temperature. This verification ensures thatboron does not precipitate out of solution in the storagetank or in the pump suction piping due to low boron solutiontemperature (below the saturation temperature for the givenconcentration). The Completion Time for performing RequiredAction A.1 is considered acceptable given the lowprobability of a Design Basis Accident (DBA) or transientoccurring concurrent with the failure of the control rods toshut down the reactor and operating experience which hasshown there are relatively slow variations in the measuredparameters of concentration and temperature over these timeperiods.

(conti nued)(continued)


SLC SystemB 3.1.7

BASES


Continued operation is only permitted for 72 hours beforeboron solution concentration must be restored to : 9.82%weight. Taking into consideration that the SLC Systemdesign capability still exists for vessel injection underthese conditions and the low probability of the temperatureand concentration limits of Figure 3.1.7-1 not being met,the allowed Completion Time of 72 hours is acceptable andprovides adequate time to restore concentration to withinlimits.

The second Completion Time for Required Action A.1establishes a limit on the maximum time allowed for anycombination of concentration out of limits or inoperable SLCsubsystems during any single contiguous occurrence offailing to meet the LCO. If Condition A is entered while,for instance, an SLC subsystem is inoperable and thatsubsystem is subsequently returned to OPERABLE, the LCO mayalready have been not met for up to 7 days. This situationcould lead to a total duration of 10 days (7 days inCondition B, followed by 3 days in Condition A), sinceinitial failure of the LCO, to restore the SLC System. Thenan SLC subsystem could be found inoperable again, andconcentration could be restored to within limits. Thiscould continue indefinitely.

This Completion Time allows for an exception to the normal"time zero" for beginning the allowed outage time "clock,"resulting in establishing the "time zero" at the time theLCO was initially not met instead of at the time Condition Awas entered. The 10 day Completion Time is an acceptablelimitation on this potential to fail to meet the LCOindefinitely.

B.1

If one SLC subsystem is inoperable for reasons other thanCondition A, the inoperable subsystem must be restored toOPERABLE status within 7 days. In this condition, theremaining OPERABLE subsystem is adequate to perform theshutdown function. However, the overall reliability isreduced because a single failure in the remaining OPERABLEsubsystem could result in the loss of SLC System shutdowncapability. The 7 day Completion Time is based on the

(continued)


SLC SystemB 3.1.7

BASES

ACTIONS B.1 (continued)

availability of an OPERABLE subsystem capable of performingthe intended SLC System function and the low probability ofa DBA or severe transient occurring concurrent with thefailure of the Control Rod Drive (CRD) System to shut downthe plant.

The- second Completion Time for Required Action B.1establishes a limit on the maximum time allowed for anycombination of concentration out of limits or inoperable SLCsubsystem during any single contiguous occurrence of failingto meet the LCO. If Condition B is entered while, forinstance, concentration is out of limits, and issubsequently returned to within limits, the LCO may alreadyhave been not met for up to 3 days. This situation couldlead to a total duration of 10 days (3 days in Condition A,followed by 7 days in Condition B), since initial failure ofthe LCO, to restore the SLC System. Then concentrationcould be found out of limits again, and the SLC subsystemcould be restored to OPERABLE. This could continueindefinitely.

This Completion Time allows for an exception to the normal"time zero" for beginning the allowed outage time "clock,"resulting in establishing the "time zero" at the time theLCO was initially not met instead of at the time Condition Bwas entered. The 10 day Completion Time is an acceptablelimitation on this potential to fail to meet the LCOindefinitely.

C.'

If both SLC subsystems are inoperable for reasons other thanCondition A, at least one subsystem must be restored toOPERABLE status within 8 hours. The allowed Completion Timeof 8 hours is considered acceptable given the lowprobability of a DBA or transient occurring concurrent withthe failure of the control rods to shut down the reactor.

D.1

If any Required Action and associated Completion Time is notmet, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must be

(continued)


SLC SystemB 3.1.7

BASES


brought to MODE 3 within 12 hours. The allowed CompletionTime of 12 hours is reasonable, based on operatingexperience, to reach MODE 3 from full power conditions in anorderly manner and without challenging plant systems.

SURVEILLANCE SR- 3.1.7.1, SR 3.1.7.2, and SR 3.1.7.3REQUIREMENTS

SR 3.1.7.1 through SR 3.1.7.3 are 24 hour Surveillancesverifying certain characteristics of the SLC System (e.g.,the level and temperature of the borated solution in thestorage tank), thereby ensuring SLC System OPERABILITYwithout disturbing normal plant operation. TheseSurveillances ensure that the proper borated solution leveland temperature, including the temperature of the pumpsuction piping, are maintained. Maintaining a minimumspecified borated solution temperature is important inensuring that the boron remains in solution and does notprecipitate out in the storage tank or in the pump suctionpiping. The temperature limit specified in SR 3.1.7.2 andSR 3.1.7.3 and the maximum sodium pentaborate concentrationspecified in Table 3.1.7-1 ensures that a 10*F margin willbe maintained above the saturation temperature. Controlroom alarms for low SLC storage tank temperature and low SLCSystem piping temperature are available and are set at 55"F.As such, SR 3.1.7.2 and SR 3.1.7.3 may be satisfied byverifying the absence of low temperature alarms for the SLCstorage tank and SLC System piping. The 24 hour Frequencyis based on operating experience and has shown there arerelatively slow variations in the measured parameters oflevel and temperature.

SR 3.1.7.4 and SR 3.1.7.6

SR 3.1.7.4 verifies the continuity of the explosive chargesin the injection valves to ensure that proper operation willoccur if required. Other administrative controls, such asthose that limit the shelf life of the explosive charges,must be followed. The 31 day Frequency is based onoperating experience and has demonstrated the reliability ofthe explosive charge continuity.

(continued)


SLC SystemB 3.1.7

BASES


SR 3.1.7.6 verifies that each valve in the system is in itscorrect position, but does not apply to the squib (i.e.,explosive) valves. Verifying the correct alignment formanual and power operated valves in the SLC System flow pathprovides assurance that the proper flow paths will exist forsystem operation. A valve is also allowed to be in thenonaccident position provided it can be aligned to theaccident position from the control room, or locally by adedicated operator at the valve control. This is acceptablesince the SLC System is a manually initiated system. ThisSurveillance also does not apply to valves that are locked,sealed, or otherwise secured in position since they areverified to be in the correct position prior to locking,sealing, or securing. This verification of valve alignmentdoes not require any testing or valve manipulation; rather,it involves verification that those valves capable of beingmispositioned are in the correct position. This SR does notapply to valves that cannot be inadvertently misaligned,such as check valves. The 31 day Frequency is based onengineering judgment and is consistent with the proceduralcontrols governing valve operation that ensures correctvalve positions.

SR 3.1.7.5

This Surveillance requires an examination of the sodiumpentaborate solution by using chemical analysis to ensurethat the proper concentration of boron exists in the storagetank. SR 3.1.7.5 must be performed anytime boron or wateris added to the storage tank solution to determine that theboron solution concentration is s 9.82% weight and withinthe limits of Table 3.1.7-1. SR 3.1.7.5 must also beperformed anytime the temperature is restored to withinlimits to ensure that no significant boron precipitationoccurred. The 31 day Frequency of this Surveillance isappropriate because of the relatively slow variation ofboron concentration between surveillances.

SR 3.1.7.7

Verifying the quantity of Boron-1O (B-10) in the SLC tankensures the reactor can be shutdown in the event that enoughcontrol rods cannot be inserted to accomplish shutdown and

(continued)


SLC SystemB 3.1.7

BASES


cooldown in the normal manner. The required quantitycontains an additional amount of B-1O equal to 25% of theminimum required amount of B-10 necessary to shutdown thereactor, to account for potential leakage and imperfectmixing. The 31 day frequency is based on operatingexperience and is appropriate because of the relatively slowvariations in the quantity of B-10 between surveillances.

SR 3.1.7.8

Demonstrating that each SLC System pump develops a flow rateZ!43.0 gpm at a discharge pressure ; 1255 psig ensures thatpump performance has not degraded below design values duringthe fuel cycle. This test is indicative of overallperformance. Such inservice inspections confirm componentOPERABILITY, trend performance, and detect incipientfailures by indicating abnormal performance. In addition,the test results for each pump are used to determine thatthe limits of Table 3.1.7-1 are satisfied for each SLCsubsystem. The Frequency of this Surveillance is inaccordance with the Inservice Testing Program.

SR 3.1.7.9

This Surveillance ensures that there is a functioning flowpath from the boron solution storage tank to the RPV,including the firing of an explosive valve. The replacementcharge for the explosive valve shall be from the samemanufactured batch as the one fired or from another batchthat has been certified by having one of that batchsuccessfully fired. The pump and explosive valve testedshould be alternated such that both complete flow paths aretested every 48 months at alternating 24 month intervals.The Surveillance may be performed in separate steps toprevent injecting boron into the RPV. An acceptable methodfor verifying flow from the pump to the RPV is to pumpdemineralized water from a test tank through one SLCsubsystem and into the RPV. The 24 month Frequency is basedon the need to perform this Surveillance under theconditions that apply during a plant outage and thepotential for an unplanned transient if the Surveillancewere performed with the reactor at power. Operatingexperience has shown these components will pass the

(continued)


SLC SystemB 3.1.7

BASES


Surveillance when performed at the 24 month Frequency;therefore, the Frequency was concluded to be acceptable froma reliability standpoint.

SR 3.1.7.10

Enriched sodium pentaborate solution is made by mixinggranular, enriched sodium pentaborate with water. In orderto ensure the proper B-10 atom percentage (in accordancewith Table 3.1.7-1) is being used, calculations must beperformed to verify the actual B-10 enrichment within 8hours after addition of the solution to the SLC tank. Thecalculations may be performed using the results of isotopictests on the granular sodium pentaborate or vendorcertification documents. The Frequency is acceptableconsidering that boron enrichment is verified during theprocurement process and any time boron is added to the SLCtank.

REFERENCES 1. 10 CFR 50.62.



SDV Vent and Drain ValvesB 3.1.8


B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves

BASES

BACKGROUND The SDV vent and drain valves are normally open anddischarge any accumulated water in the SDV to ensure thatsufficient volume is available at all times to allow acomplete scram. During a scram, the SDV vent and drainvalves close to contain reactor water. As discussed inReference 1, the SDV vent and drain valves need not beconsidered primary containment isolation valves (PCIVs) forthe Scram Discharge System. (However, at PBAPS, thesevalves are considered PCIVs.) The SDV is a volume of headerpiping that connects to each hydraulic control unit (HCU)and drains into an instrument volume. There are two SDVs(headers) and a common instrument volume that receives allof the control rod drive (CRD) discharges. The instrumentvolume is connected to a common drain line with two valvesin series. Each header is connected to a common vent linewith two valves in series for a total of four vent valves.The header piping is sized to receive and contain all thewater discharged by the CRDs during a scram. The design andfunctions of the SDV are described in Reference 2.


The Design Basis Accident and transient analyses assume allof the control rods are capable of scramming. Theacceptance criteria for the SDV vent and drain valves arethat they operate automatically to close during scram tolimit the amount of reactor coolant discharged so thatadequate core cooling is maintained and offsite doses remainwithin the limits of 10 CFR 100 (Ref. 3).

Isolation of the SDV can also be accomplished by manualclosure of the SDV valves. Additionally, the discharge ofreactor coolant to the SDV can be terminated by scram resetor closure of the HCU manual isolation valves. For abounding leakage case, the offsite doses are well within thelimits of 10 CFR 100 (Ref. 3), and adequate core cooling ismaintained (Ref. 1). The SDV vent and drain valves allowcontinuous drainage of the SDV during normal plant operationto ensure that the SDV has sufficient capacity to containthe reactor coolant discharge during a full core scram. Toautomatically ensure this capacity, a reactor scram(LCO 3.3.1.1, "Reactor Protection System (RPS)Instrumentation") is initiated if the SDV water level in the

(continued)



BASES

APPLICABLE instrument volume exceeds a specified setpoint. TheSAFETY ANALYSES setpoint is chosen so that all control rods are inserted

(continued) before the SDV has insufficient volume to accept a fullscram.

SDV vent and drain valves satisfy Criterion 3 of the NRCPolicy Statement.

LCO The OPERABILITY of all SDV vent and drain valves ensuresthat the SDV vent and drain valves will close during a scramto contain reactor water discharged to the SDV piping.Since the vent and drain lines are provided with two valvesin series, the single failure of one valve in the openposition will not impair the isolation function of thesystem. Additionally, the valves are required to be openedfollowing scram reset to ensure that a path is available forthe SDV piping to drain freely at other times.

APPLICABILITY In MODES I and 2, scram may be required; therefore, the SDVvent and drain valves must be OPERABLE. In MODES 3 and 4,control rods are not able to be withdrawn since the reactormode switch is in shutdown and a control rod block isapplied. This provides adequate controls to ensure thatonly a single control rod can be withdrawn. Also, duringMODE 5, only a single control rod can be withdrawn from acore cell containing fuel assemblies. Therefore, the SDVvent and drain valves are not required to be OPERABLE inthese MODES since the reactor is subcritical and only onerod may be withdrawn and subject to scram.

ACTIONS The ACTIONS Table is modified by Notes indicating that aseparate Condition entry is allowed for each SDV vent anddrain line. This is acceptable, since the Required Actionsfor each Condition provide appropriate compensatory actionsfor each inoperable SDV line. Complying with the RequiredActions may allow for continued operation, and subsequentinoperable SDV lines are governed by subsequent Conditionentry and application of associated Required Actions.

When a line is isolated, the potential for an inadvertentscram due to high SDV level is increased. During theseperiods, the line may be unisolated under administrativecontrol. This allows any accumulated water in the line tobe drained, to preclude a reactor scram on SDV high level.This is acceptable since the administrative controls ensurethe valve can be closed quickly, by a dedicated operator, ifa scram occurs with the valve open.

(continued)

I



BASES

ACTIONS A.1(continued)

When one SDV vent or drain valve is inoperable in one ormore lines, the associated line must be isolated to containthe reactor coolant during a scram. The 7 day CompletionTime is reasonable, given the level of redundancy in thelines and the low probability of a scram occurring duringthe time the valves are inoperable and the line is notisolated. The SDV is still isolable since the redundantvalve in the affected line is OPERABLE. During theseperiods, the single failure criterion may not be preserved,and a higher risk exists to allow reactor water out of theprimary system during a scram.

B.1

If both valves in a line are inoperable, the line must beisolated to contain the reactor coolant during a scram.

The 8 hour Completion Time to isolate the line is based onthe low probability of a scram occurring while the line isnot isolated and unlikelihood of significant CRD sealleakage.

C.1

If any Required Action and associated Completion Time is notmet, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 12 hours. The allowedCompletion Time of 12 hours is reasonable, based onoperating experience, to reach MODE 3 from full powerconditions in an orderly manner and without challengingplant systems.

(continued)



BASES (continued)


During normal operation, the SDV vent and drain valvesshould be in the open position (except when performingSR 3.1.8.2 or SR 3.3.1.1.9 for Function 13, Manual Scram, ofTable 3.3.1.1-1) to allow for drainage of the SDV piping.Verifying that each valve is in the open position ensuresthat the SDV vent and drain valves will perform theirintended functions during normal operation. This SR doesnot require any testing or valve manipulation; rather, itinvolves verification that the valves are in the correctposition.

The 31 day Frequency is based on engineering judgment and isconsistent with the procedural controls governing valveoperation, which ensure correct valve positions.

SR 3.1.8.2

During a scram, the SDV vent and drain valves should closeto contain the reactor water discharged to the SDV piping.Cycling each valve through its complete range of motion(closed and open) ensures that the valve will functionproperly during a scram. The 92 day Frequency is based onoperating experience and takes into account the level ofredundancy in the system design.

SR 3.1.8.3

SR 3.1.8.3 is an integrated test of the SDV vent and drainvalves to verify total system performance. After receipt ofa simulated or actual scram signal, the closure of the SDVvent and drain valves is verified. The closure time of15 seconds after receipt of a scram signal is based on thebounding leakage case evaluated in the accident analysis(Ref. 2). The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1and the scram time testing of control rods in LCO 3.1.3overlap this Surveillance to provide complete testing of theassumed safety function. The 24 month Frequency is based onthe need to perform this Surveillance under the conditionsthat apply during a plant outage and the potential for an

(continued)



BASES


unplanned transient if the Surveillance were performed withthe reactor at power. Operating experience has shown thesecomponents will pass the Surveillance when performed at the24 month Frequency; therefore, the Frequency was concludedto be acceptable from a reliability standpoint.

REFERENCES I. NUREG-0803, "Generic Safety Evaluation ReportRegarding Integrity of BWR Scram System Piping,"August 1981.

2. UFSAR, Sections 3.4.5.3.1 and 7.2.3.6.

3. 10 CFR 100.

0PBAPS UNIT 2 B 3.1-52 Revision No. 0

APLHGRB 3.2.1


B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)

BASES

BACKGROUND The APLHGR is a measure of the average LHGR of all the fuelrods in a fuel assembly at any axial location. Limits onthe APLHGR are specified to ensure that the peak claddingtemperature (PCT) during the postulated design basis loss ofcoolant accident (LOCA) does not exceed the limits specifiedin 10 CFR 50.46.


The analytical methods and assumptions used in evaluatingDesign Basis Accidents (DBAs) that determine the APLHGRlimits are presented in References 1, 2, 3, 4, 5, and 7.

(conti nued)


APLHGRB 3.2.1

BASES


(continued)

LOCA analyses are performed to ensure that the APLHGR limitsare adequate to meet the PCT and maximum oxidation limits of10 CFR 50.46. The analysis is performed using calculationalmodels that are consistent with the requirements of10 CFR 50, Appendix K. A complete discussion of theanalysis code is provided in Reference 11. The PCT followinga postulated LOCA is a function of the average heatgeneration rate of all the rods of a fuel assembly at anyaxial location and is not strongly influenced by the rod torod power distribution within an assembly. A conservativemultiplier is applied to the LHGR assumed in the LOCAanalysis to account for the uncertainty associated with themeasurement of the APLHGR.

For single recirculation loop operation, a conservativemultiplier is applied to the APLHGR as specified in the COLR(Ref. 12). This is due to the conservative analysisassumption of an earlier departure from nucleate boiling withone recirculation loop available, resulting in a more severecladding heatup during a LOCA.

Power-dependent and flow-dependent APLHGR adjustment factorsmay also be provided per Reference 1 to ensure that fueldesign limits are not exceeded due to the occurrence of apostulated transient event during operation at off-rated(less than 100%) reactor power or core flow conditions.These adjustment factors are applied, if required, per theCOLR and decrease the allowable APLHGR value.

The APLHGR satisfies Criterion 2 of the NRC PolicyStatement.

LCO The APLHGR limits specified in the COLR are the result ofthe fuel design and DBA analyses. The limits are developedas a function of exposure and are applied per the COLR.

(continued)


APLHGRB 3.2.1

BASES

LCO(continued) With only one recirculation loop in operation, in

conformance with the requirements of LCO 3.4.1,"Recirculation Loops Operating," the limit is determined bymultiplying the exposure dependent APLHGR limit by aconservator factor.

APPLICABILITY The APLHGR limits are primarily derived from LOCA analysesthat are assumed to occur at high power levels. Designcalculations (Ref. 6) and operating experience have shownthat as power is reduced, the margin to the required APLHGRlimits increases. This trend continues down to the powerrange of 5% to 15% RTP when entry into MODE 2 occurs. Whenin MODE 2, the wide range neutron monitor period-short scramfunction provides prompt scram initiation during anysignificant transient, thereby effectively removing anyAPLHGR limit compliance concern in MODE 2. Therefore, atTHERMAL POWER levels < 25% RTP, the reactor is operatingwith substantial margin to the APLHGR limits; thus, this LCOis not required.

ACTIONS A.1

If any APLHGR exceeds the required limits, an assumptionregarding an initial condition of the DBA analyses may notbe met. Therefore, prompt action should be taken to restorethe APLHGR(s) to within the required limits such that theplant operates within analyzed conditions and within designlimits of the fuel rods. The 2 hour Completion Time issufficient to restore the APLHGR(s) to within its limits andis acceptable based on the low probability of a DBAoccurring simultaneously with the APLHGR out ofspecification.

B.1

If the APLHGR cannot be restored to within its requiredlimits within the associated Completion Time, the plant mustbe brought to a MODE or other specified condition in whichthe LCO does not apply. To achieve this status, THERMALPOWER must be reduced to < 25% RTP within 4 hours. The

I

(conti nued)


APLHGRB 3.2.1

BASES


allowed Completion Time is reasonable, based on operatingexperience, to reduce THERMAL POWER to < 25% RTP in anorderly manner and without challenging plant systems.


APLHGRs are required to be initially calculated within12 hours after THERMAL POWER is 2 25% RTP and then every24 hours thereafter. They are compared to the specifiedlimits in the COLR to ensure that the reactor is operatingwithin the assumptions of the safety analysis. The 24 hourFrequency is based on both engineering judgment andrecognition of the slowness of changes in power distributionduring normal operation. The 12 hour allowance afterTHERMAL POWER > 25% RTP is achieved is acceptable given thelarge inherent margin to operating limits at low powerlevels.

REFERENCES 1. NEDO-24011-P-A, "General Electric Standard Applicationfor Reactor Fuel," latest approved revision. W




5. NEDO-24229-1, "Peach Bottom Atomic Power Station Units2 and 3, Single Loop Operation," May 1980.

6. NEDC-32162P, "Maximum Extended Load Line Limit andARTS Improvement Program Analyses for Peach BottomAtomic Power Station Units 2 and 3," Revision 2, March1995.

7. NEDC-32183P, "Power Rerate Safety Analysis Report forPeach Bottom 2 & 3," May 1993.

8. Deleted

9. NEDO-30130-A, "Steady State Nuclear Methods,"April 1985.

(continued)


APLHGRB 3.2.1

BASES

REFERENCES 10. Deleted(continued)

11. NEDC-32163P, "Peach Bottom Atomic Power Station Units2 and 3 SAFER/GESTR-LOCA Loss-of-Coolant AccidentAnalysis," January 1993.

12. Peach Bottom Unit 2 Core Operating Limits Report(COLR).


MCPRB 3.2.2


B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR)

BASES

BACKGROUND MCPR is a ratio of the fuel assembly power that would resultin the onset of boiling transition to the actual fuelassembly power. The MCPR Safety Limit (SL) is set such that99ý9% of the fuel rods avoid boiling transition if the limitis not violated (refer to the Bases for SL 2.1.1.2). Theoperating limit MCPR is established to ensure that no fueldamage results during abnormal operational transients.Although fuel damage does not necessarily occur if a fuelrod actually experienced boiling transition (Ref. 1), thecritical power at which boiling transition is calculated tooccur has been adopted as a fuel design criterion.

The onset of transition boiling is a phenomenon that isreadily detected during the testing of various fuel bundledesigns. Based on these experimental data, correlationshave been developed to predict critical bundle power (i.e.,the bundle power level at the onset of transition boiling)for a given set of plant parameters (e.g., reactor vessel

.pressure, flow, and subcooling). Because plant operatingconditions and bundle power levels are monitored anddetermined relatively easily, monitoring the MCPR is aconvenient way of ensuring that fuel failures due toinadequate cooling do not occur.


The analytical methods and assumptions used in evaluatingthe abnormal operational transients to establish theoperating limit MCPR are presented in References 2, 3, 4, 5,6, 7, 8, and 9. To ensure that the MCPR SL is not exceededduring any transient event that occurs with moderatefrequency, limiting transients have been analyzed todetermine the largest reduction in critical power ratio(CPR). The types of transients evaluated are loss of flow,increase in pressure and power, positive reactivityinsertion, and coolant temperature decrease. The limitingtransient yields the largest change in CPR (ACPR). When thelargest ACPR (corrected for analytical uncertainties) isadded to the MCPR SL, the required operating limit MCPR isobtained.

(continued)


MCPRB 3.2.2

BASES


(continued)

The MCPR operating limits derived from the transientanalysis are dependent on the operating core flow and powerstate (MCPRf and MCPRP, respectively) to ensure adherence tofuel design limits during the worst transient that occurswith moderate frequency (Refs. 6, 7, 8, and 9). Flowdependent MCPR limits are determined by steady state thermalhydraulic methods with key physics response inputsbenchmarked using the three dimensional BWR simulatorcode (Ref. 10) to analyze slow flow runout transients. Theflow dependent operating limit, MCPRf, is evaluated based ona single recirculation pump flow runout event (Ref. 9).

Power dependent MCPR limits (MCPRP) are determined mainly bythe one dimensional transient code (Ref. 11). Due to thesensitivity of the transient response to initial core flowlevels at power levels below those at which the turbine stopvalve closure and turbine control valve fast closure scramsare bypassed, high and low flow MCPRP operating limits areprovided for operating between 25% RTP and the previouslymentioned bypass power level.

The MCPR satisfies Criterion 2 of the NRC Policy Statement.

LCO The MCPR operating limits specified in the COLR are theresult of the Design Basis Accident (DBA) and transientanalysis. The operating limit MCPR is determined by thelarger of the MCPR, and MCPRP limits.

APPLICABILITY The MCPR operating limits are primarily derived fromtransient analyses that are assumed to occur at high powerlevels. Below 25% RTP, the reactor is operating at aminimum recirculation pump speed and the moderator voidratio is small. Surveillance of thermal limits below25% RTP is unnecessary due to the large inherent margin thatensures that the MCPR SL is not exceeded even if a limitingtransient occurs. Statistical analyses indicate that thenominal value of the initial MCPR expected at 25% RTP is> 3.5. Studies of the variation of limiting transientbehavior have been performed over the range of power and

(continued)


MCPRB 3.2.2

BASES

APPLICABILITY(continued)

flow conditions. These studies encompass the range of keyactual plant parameter values important to typicallylimiting transients. The results of these studiesdemonstrate that a margin is expected between performanceand the MCPR requirements, and that margins increase aspower is reduced to 25% RTP. This trend is expected tocontinue to the 5% to 15% power range when entry into MODE 2occurs. When in MODE 2, the wide range neutron monitorperiod-short function provides rapid scram initiation forany significant power increase transient, which effectivelyeliminates any MCPR compliance concern. Therefore, atTHERMAL POWER levels < 25% RTP, the reactor is operatingwith substantial margin to the MCPR limits and this LCO isnot required.

ACTIONS A.__

If any MCPR is outside the required limits, an assumptionregarding an initial condition of the design basis transientanalyses may not be met. Therefore, prompt action should betaken to restore the MCPR(s) to within the required limitssuch that the plant remains operating within analyzedconditions. The 2 hour Completion Time is normallysufficient to restore the MCPR(s) to within its limits andis acceptable based on the low probability of a transient orDBA occurring simultaneously with the MCPR out ofspecification.

B.1

If the MCPR cannot be restored to within its required limitswithin the associated Completion Time, the plant must bebrought to a MODE or other specified condition in which theLCO does not apply. To achieve this status, THERMAL POWERmust be reduced to < 25% RTP within 4 hours. The allowedCompletion Time is reasonable, based on operatingexperience, to reduce THERMAL POWER to < 25% RTP in anorderly manner and without challenging plant systems.


SR 3.2.2.1

The MCPR is required to be initially calculated within12 hours after THERMAL POWER is > 25% RTP and then every24 hours thereafter. It is compared to the specified limits

(continued) *


MCPRB 3.2.2

BASES


in the COLR (Ref. 12) to ensure that the reactor isoperating within the assumptions of the safety analysis.The 24 hour Frequency is based on both engineering judgmentand recognition of the slowness of changes in powerdistribution during normal operation. The 12 hour allowanceafter THERMAL POWER Ž 25% RTP is achieved is acceptable giventhe large inherent margin to operating limits at low powerlevels.

SR 3.2.2.2

Because the transient analysis takes credit for conservatismin the scram speed performance, it must be demonstrated thatthe specific scram speed distribution is consistent withthat used in the transient analysis. SR 3.2.2.2 determinesthe value of r, which is a measure of the actual scram speeddistribution compared with the assumed distribution. TheMCPR operating limit is then determined based on aninterpolation between the applicable limits for Option A(scram times of LCO 3.1.4,"Control Rod Scram Times") andOption B (realistic scram times) analyses. The parameter Tmust be determined once within 72 hours after each set ofscram time tests required by SR 3.1.4.1, SR 3.1.4.2, andSR 3.1.4.4 because the effective scram speed distributionmay change during the cycle or after maintenance that couldaffect scram times. The 72 hour Completion Time isacceptable due to the relatively minor changes in T expectedduring the fuel cycle.

REFERENCES 1. NUREG-0562, June 1979.

2. NEDO-24011-P-A, "General Electric StandardApplication for Reactor Fuel," latest approvedrevision.




6. NEDO-24229-1, "Peach Bottom Atomic Power Station Units2 and 3, Single Loop Operation," May 1980.

(continued)


MCPRB 3.2.2

BASES

REFERENCES(continued)

7. NEDC-32162P, "Maximum Extended Load Line Limit andARTS Improvement Program Analyses for Peach BottomAtomic Power Station Units 2 and 3," Revision 2,March 1995.


9. NEDC-32428P, "Peach Bottom Atomic Power Station Unit 2Cycle 11 ARTS Thermal Limits Analyses," December 1994.

10. NEDO-30130-A, "Steady State Nuclear Methods,"April 1985.

11. NEDO-24154, "Qualification of the One-Dimensional CoreTransient Model for Boiling Water Reactors,"October 1978.


9


LHGRB 3.2.3


B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR)

BASES

BACKGROUND The LHGR is a measure of the heat generation rate of a fuelrod in a fuel assembly at any axial location. Limits onLHGR are specified to ensure that fuel design limits are notexceeded anywhere in the core during normal operation,including abnormal operational transients. Exceeding theLHGR limit could potentially result in fuel damage andsubsequent release of radioactive materials. Fuel designlimits are specified to ensure that fuel system damage, fuelrod failure, or inability to cool the fuel does not occurduring the anticipated operating conditions identified inReference 1.


The analytical methods and assumptions used in evaluatingthe fuel system design are presented in References 1, 2, 3,4, 5, 6, 7, arid 8. The fuel assembly is designed to ensure(in conjunction with the core nuclear and thermal hydraulicdesign, plant equipment, instrumentation, and protectionsystem) that fuel damage will not result in the release ofradioactive materials in excess of the guidelines of 10 CFR,Parts 20, 50, and 100. The mechanisms that could cause fueldamage during operational transients and that are consideredin fuel evaluations are:

a. Rupture of the fuel rod cladding caused by strainthe relative expansion of the U02 pellet; and

from

b. Severe overheating of the fuel rod cladding caused byinadequate cooling.

A value of 1% plastic strain of the fuel cladding has beendefined as the limit below which fuel damage caused byoverstraining of the fuel cladding is not expected to occur(Ref. 9).

Fuel design evaluations have been performed and demonstratethat the 1% fuel cladding plastic strain design limit is notexceeded during continuous operation with LHGRs up to theoperating limit specified in the COLR. The analysis also

(continued)


LHGRB 3.2.3

BASES


(continued)

includes allowances for short term transient operation abovethe operating limit to account for abnormal operationaltransients, plus an allowance for densification powerspiking.

Power-dependent and flow-dependent LHGR adjustment factorsmay also be provided per Reference 1 to ensure that fueldesign limits are not exceeded due to the occurrence of apostulated transient event during operation at off-rated(less than 100%) reactor power or core flow conditions.These adjustment factors are applied, if required, per theCOLR and decrease the allowable LHGR value.

Additionally, for single recirculation loop operation, anLHGR multiplier may be provided per Reference 1. Thismultiplier is applied per the COLR and decreases theallowable LHGR value. This additional margin may benecessary during SLO to account for the conservative analysisassumption of an earlier departure from nucleate boiling withonly one recirculation loop available.

The LHGR satisfies Criterion 2 of the NRC Policy Statement.

LCO The LHGR is a basic assumption in the fuel design analysis.The fuel has been designed to operate at rated core powerwith sufficient design margin to the LHGR calculated tocause a 1% fuel cladding plastic strain. The operatinglimit to accomplish this objective is specified in the COLR.

APPLICABILITY The LHGR limits are derived from fuel design analysis thatis limiting at high power level conditions. At core thermalpower levels < 25% RTP, the reactor is operating with asubstantial margin to the LHGR limits and, therefore, theSpecification is only required when the reactor is operati-ngat 2 25% RTP.

ACTIONS A.I

If any LHGR exceeds its required limit, an assumptionregarding an initial condition of the fuel design analysisis not met. Therefore, prompt action should be taken torestore the LHGR(s) to within its required limits such thatthe plant is operating within analyzed conditions. The

(continued) 0


LHGRB 3.2.3

BASES


2 hour Completion Time is normally sufficient to restore theLHGR(s) to within its limits and is acceptable based on thelow probability of a transient or Design Basis Accidentoccurring simultaneously with the LHGR out of specification.

B.1

If the LHGR cannot be restored to within its required limitswithin the associated Completion Time, the plant must bebrought to a MODE or other specified condition in which theLCO does not apply. To achieve this status, THERMAL POWERis reduced to < 25% RTP within 4 hours. The allowedCompletion Time is reasonable, based on operatingexperience, to reduce THERMAL POWER TO < 25% RTP in anorderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 2 B 3.2-12a Revision No. 49 I

LHGRB 3.2.3

BASES (continued)


The LHGR is required to be initially calculated within12 hours after THERMAL POWER is Ž 25% RTP and then every24 hours thereafter. It is compared to the specified limitsin the COLR (Ref. 10) to ensure that the reactor isoperating within the assumptions of the safety analysis.The 24 hour Frequency is based on both engineering judgmentand recognition of the slow changes in power distributionduring normal operation. The 12 hour allowance afterTHERMAL POWER Ž 25% RTP is achieved is acceptable given thelarge inherent margin to operating limits at lower powerlevel s.

REFERENCES 1. NEDO-24011-P-A, "General Electric Standard Application

for Reactor Fuel," latest approved revision.




5. NEDO-24229-1, !'Peach Bottom Atomic Power Station Units2 and 3, Single-Loop Operation," May 1980.

6. NEDC-32162P, "Maximum Extended Load Line Limit andARTS Improvements Program Analyses for Peach BottomAtomic Power Station Units 2 and 3," Revision 2,March 1995.


8. NEDC-32163P, "Peach Bottom Atomic Power Station Units2 and 3 SAFER/GESTR-LOCA Loss-of-Coolant AccidentAnalysis," January 1993.

9. NUREG-0800, Section 4.2, Subsection II.A.2(g),Revision 2, July 1981.



RPS InstrumentationB 3.3.1.1


B 3.3.1.1 Reactor Protection System (RPS) Instrumentation

BASES

BACKGROUND The RPS initiates a reactor scram when one or more monitoredparameters exceed their specified limits, to preserve theintegrity of the fuel cladding and the Reactor CoolantSystem (RCS) and minimize the energy that must be absorbedfollowing a loss of coolant accident (LOCA). This can beaccomplished either automatically or manually.

The protection and monitoring functions of the RPS have beendesigned to ensure safe operation of the reactor. This isachieved by specifying limiting safety system settings(LSSS) in terms of parameters directly monitored by the RPS,as well as LCOs on other reactor system parameters andequipment performance. The LSSS are defined in thisSpecification as the Allowable Values, which, in conjunctionwith the LCOs, establish the threshold for protective systemaction to prevent exceeding acceptable limits, includingSafety Limits (SLs) during Design Basis Accidents (DBAs).

The RPS, as shown in the UFSAR Section 7.2, (Ref. 1),includes sensors, relays, bypass circuits, and switches thatare necessary to cause initiation of a reactor scram.Functional diversity is provided by monitoring a wide rangeof dependent and independent parameters. The inputparameters to the scram logic are from instrumentation thatmonitors reactor vessel water level, reactor vesselpressure, neutron flux, main steam line isolation valveposition, turbine control valve (TCV) fast closure trip oilpressure, turbine stop valve (TSV) position, drywellpressure, scram discharge volume (SDV) water level,condenser vacuum, main steam line radiation, as well asreactor mode switch in shutdown position, manual scramsignals, and RPS test switches. There are at least fourredundant sensor input signals from each of these parameters(with the exception of the manual scram signal and thereactor mode switch in shutdown scram signal). Mostchannels include electronic equipment (e.g., trip units)that compares measured input signals with pre-establishedsetpoints. When the setpoint is exceeded, the channeloutput relay actuates, which then outputs an RPS trip signalto the trip logic.

(continued)



BASES


The RPS is comprised of two independent trip systems(A and B) with three logic channels in each trip system(logic channels Al, A2, and A3; BI, B2, and B3) as shown inthe Reference I figures. Logic channels Al, A2, BI, and B2contain automatic logic for which the above monitoredparameters each have at least one input to each of theselogic channels. The outputs of the logic channels in a tripsystem are combined in a one-out-of-two logic so that eitherchannel can trip the associated trip system. The trippingof both trip systems will produce a reactor scram. Thislogic arrangement is referred to as a one-out-of-two takentwice logic. In addition to the automatic logic channels,logic channels A3 and B3 (one logic channel per trip system)are manual scram channels. Both must be depressed in orderto initiate the manual trip function. Each trip system canbe reset by use of a reset switch. If a full scram occurs(both trip systems trip), a relay prevents reset of the tripsystems for 10 seconds after the full scram signal isreceived. This 10 second delay on reset ensures that thescram function will be completed.

Two scram pilot valves are located in the hydraulic controlunit for each control rod drive (CRD). Each scram pilotvalve is solenoid operated, with the solenoids normallyenergized. The scram pilot valves control the air supply-tothe scram inlet and outlet valves for the associated CRD.When either scram pilot valve solenoid is energized, airpressure holds the scram valves closed and, therefore, bothscram pilot valve solenoids must be de-energized to cause acontrol rod to scram. The scram valves control the supplyand discharge paths for the CRD water during a scram. Oneof the scram pilot valve solenoids for each CRD iscontrolled by trip system A, and the other solenoid iscontrolled by trip system B. Any trip of trip system A inconjunction with any trip in trip system B results inde-energizing both solenoids, air bleeding off, scram valvesopening, and control rod scram.

The backup scram valves, which energize on a scram signal todepressurize the scram air header, are also controlled bythe RPS. Additionally, the RPS controls the SDV vent anddrain valves such that when logic channels Al and BI aredeenergized or when logic channel A3 is deenergized the

(continued)



BASES


inboard SDV vent and drain valves close to isolate the SDV,and when logic channels A2 and B2 are deenergized or whenlogic channel B3 is deenergized the outboard SDV vent anddrain-valves close to isolate the SDV.

APPLICABLESAFETY ANALYSES,LCO, andAPPLICABILITY

The actions of the RPS are assumed in the safety analyses ofReferences 2 and 3. The RPS is required to initiate areactor scram when monitored parameter values exceed theAllowable Values, specified by the setpoint methodology andlisted in Table 3.3.1.1-1, to maintain OPERABILITY and topreserve the integrity of the fuel cladding, the reactorcoolant pressure boundary (RCPB), and the containment, byminimizing the energy that must be absorbed following aLOCA.

RPS instrumentation satisfies Criterion 3 of the NRC PolicyStatement. Functions not specifically credited in theaccident analysis are retained for the overall redundancyand diversity of the RPS as required by the NRC approvedlicensing basis.

The OPERABILITY of the RPS is dependent on the OPERABILITYof the individual instrumentation channel Functionsspecified in Table 3.3.1.1-1. Each Function must have arequired number of OPERABLE channels per RPS trip system,with their setpoints within the specified Allowable Value,where appropriate. The actual setpoint is calibratedconsistent with applicable setpoint methodology assumptions.

Allowable Values, where applicable, are specified for eachRPS Function specified in the Table. Trip setpoints arespecified in the setpoint calculations. The trip setpointsare selected to ensure that the actual setpoints do notexceed the Allowable Value between successive CHANNELCALIBRATIONS. Operation with a trip setting lessconservative than the trip setpoint, but within itsAllowable Value, is acceptable. A channel is inoperable ifits actual trip setting is not within its required AllowableValue.

Trip setpoints are those predetermined values of output atwhich an action should take place. The setpoints arecompared to the actual process parameter (e.g., reactorvessel water level), and when the measured output value of

(continued)



BASES


(continued)

the process parameter exceeds the setpoint, the associateddevice (e.g., trip unit) changes state. The analytic ordesign limits are derived from the limiting values of theprocess parameters obtained from the safety analysis orother appropriate documents. The Allowable Values arederived from the analytic or design limits, corrected forcalibration, process, and instrument errors. The tripset-points are determined from analytical or design limits,corrected for calibration, process, and instrument errors,as well as instrument drift. In selected cases, theAllowable Values and trip setpoints are determined byengineering judgement or historically accepted practicerelative to the intended function of the trip channel. Thetrip setpoints determined in this manner provide adequateprotection by assuring instrument and process uncertaintiesexpected for the environments during the operating time ofthe associated trip channels are accounted for.

The OPERABILITY of scram pilot valves and associatedsolenoids, backup scram valves, and SDV valves, describedthe Background section, are not addressed by this LCO.

in

The individual Functions are required to be OPERABLE in theMODES or other specified conditions specified in the Table,which may require an RPS trip to mitigate the consequencesof a design basis accident or transient. To ensure areliable scram function, a combination of Functions arerequired in each MODE to provide primary and diverseinitiation signals.

The only MODES specified in Table 3.3.1.1-1 are MODES 1 and2, and MODE 5 with any control rod withdrawn from a corecell containing one or more fuel assemblies. No RPSFunction is required in MODES 3 and 4, since all controlrods are fully inserted and the Reactor Mode Switch ShutdownPosition control rod withdrawal block (LCO 3.3.2.1) does notallow any control rod to be withdrawn. In MODE 5, controlrods withdrawn from a core cell containing no fuelassemblies do not affect the reactivity of the core and,therefore, are not required to have the capability to scram.Provided all other control rods remain inserted, no RPSfunction is required. In this condition, the required SDM(LCO 3.1.1) and refuel position one-rod-out interlock(LCO 3.9.2) ensure that no event requiring RPS will occur.

(continued)



BASES

APPLICABLE The specific Applicable Safety Analyses, LCO, andSAFETY ANALYSES, Applicability discussions are listed below on a Function byLCO, and Function basis.APPLICABILITY

(continued)Wide Range Neutron Monitor (WRNM)

1.a. Wide Range Neutron Monitor Period-Short

The WRNMs provide signals to facilitate reactor scram in theevent that core reactivity increase (shortening period)exceeds a predetermined reference rate. -To determine thereactor period, the neutron flux signal is filtered. Theperiod of this filtered neutron flux signal is used togenerate trip signals when the respective trip setpoints areexceeded. The time to trip for a particular reactor periodis dependent on the filter time constant, actual period ofthe signal and the trip setpoints. This period based signalis available over the entire operating range from initialcontrol rod withdrawal to full power operation. In thestartup range, the most significant source of reactivitychange is due to control rod withdrawal. The WRNM providesdiverse protection from the rod worth minimizer (RWM), whichmonitors and controls the movement of control rods at lowpower. The RWM prevents the withdrawal of an out ofsequence control rod during startup that could result in anunacceptable neutron flux excursion (Ref. 2). The WRNMprovides mitigation of the neutron flux excursion. Todemonstrate the capability of the WRNM System to mitigatecontrol rod withdrawal events, an analysis has beenperformed (Ref. 3) to evaluate the consequences of controlrod withdrawal events during startup that are mitigated onlyby the WRNM period-short function. The withdrawal of acontrol rod out of sequence, during startup, analysis (Ref.3) assumes that one WRNM channel in each trip system isbypassed, demonstrates that the WRNMs provide protectionagainst local control rod withdrawal errors and results inpeak fuel enthalpy below the 170 cal/gm fuel failurethreshold criterion.

The WRNMs are also capable of limiting other reactivityexcursions during startup, such as cold water injectionevents, although no credit is specifically assumed.

(continued)



BASES


l.a. Wide Range Neutron Monitor Period-Short(continued)

The WRNM System is divided into two groups of WRNM channels,with four channels inputting to each trip system. Theanalysis of Reference 3 assumes that one channel in eachtrip system is bypassed. Therefore, six channels with threechannels in each trip system are required for WRNMOPERABILITY to ensure that no single instrument failure willpreclude a scram from this Function on a valid signal.

The analysis of Reference 3 has adequate-conservatism topermit an Allowable Value of 13 seconds.

The WRNM Period-Short Function must be OPERABLE duringMODE 2 when control rods may be withdrawn and the potentialfor criticality exists. In MODE 5, when a cell with fuelhas its control rod withdrawn, the WRNMs provide monitoringfor and protection against unexpected reactivity excursions.In MODE 1, the APRM System and the RWM provide protectionagainst control rod withdrawal error events and the WRNMsare not required. The WRNMs are automatically bypassed whenthe mode switch is in the Run position.

I.b. Wide RanQe Neutron Monitor-InoD

This trip signal provides assurance that a minimum number ofWRNMs are OPERABLE. Anytime a WRNM mode switch is moved toany position other than "Operate," a loss of power occurs,or the self-test system detects a failure which would resultin the loss of a safety-related function, an inoperativetrip signal will be received by the RPS unless the WRNM isbypassed. Since only one WRNM in each trip system may bebypassed, only one WRNM in each RPS trip system may beinoperable without resulting in an RPS trip signal.

This Function was not specifically credited in the accidentanalysis but it is retained for the overall redundancy anddiversity of the RPS as required by the NRC approvedlicensing basis.

(continued)



BASES

APPLICABLE 1.b. Wide Range Neutron Monitor-Inop (continued)SAFETY ANALYSES,LCO, and Six channels of the Wide Range Neutron Monitor-lnopAPPLICABILITY Function, with three channels in each trip system, are

required to be OPERABLE to ensure that no single instrumentfailure will preclude a scram from this Function on a validsignal. Since this Function is not assumed in the safetyanalysis, there is no Allowable Value for this Function.

This Function is required to be OPERABLE when the Wide RangeNeutron Monitor Period-Short Function is required.

Average Power Range Monitor (APRM)

The APRM channels provide the primary indication of neutronflux within the core and respond almost instantaneously toneutron flux increases. The APRM channels receive inputsignals from the local power range monitors (LPRMs) withinthe reactor core to provide an indication of the powerdistribution and local power changes. The APRM channelsaverage these LPRM signals to provide a continuousindication of average reactor power from a few percent togreater than RTP. Each APRM also includes an OscillationPower Range Monitor (OPRM) Upscale Function which monitorssmall groups of LPRM signals to detect thermal-hydraulicinstabilities.

The APRM System is divided into four APRM channels and four2-out-of-4 voter channels. Each APRM channel providesinputs to each of the four voter channels. The four voterchannels are divided into two groups of two each, with eachgroup of two providing inputs to one RPS trip system. Thesystem is designed to allow one APRM channel, but no voterchannels to be bypassed. A trip from any one unbypassedAPRM will result in a "half-trip' in all four of the voterchannels, but no trip inputs to either RPS trip system.APRM trip Functions 2.a, 2.b, 2.c, and 2.d are votedindependently from OPRM Upscale Function 2.f. Therefore,any Function 2.a, 2.b, 2.c, or 2.d trip from any twounby passed APRM channels will result in a full trip in eachof the four voter channels, which in turn results in twotrip inputs into each RPS trip system logic channel (Al, A2,Bi, and B2), thus resulting in a full scram signal.Similarly, a Function 2.f trip from any two unbypassed APRMchannels will result in a full trip from each of the fourvoter channels. Three of the four APRM channels and allfour of the voter channels are required to be OPERABLE toensure that no single failure will preclude a scram on avalid signal. In addition, to provide adequate coverage ofthe entire core, consistent with the design bases for-theAPRM Functions 2.a, 2.b, and 2.c, at least 20 LPRM inputs,with at least three LPRM inputs from each of the four axiallevels at which the LPRMs are located, must be operable foreach APRM channel, and the number of LPRM inputs that havebecome inoperable (and bypassed) since the last APRMcalibration (SR 3.3.1.1.2) must be less than ten for eachAPRM channel. For the OPRM Upscale, Function 2.f, LPRMs areassigned to "cells" of 3 or 4 detectors. A minimum of 25cells per channel, each with a minimum of 2 OPERABLE LPRMs,must be OPERABLE for the OPRM Upscale Function 2.f to beOPERABLE.

(continued)PBAPS UNIT 2 B 3.3-7 Revision No. 54


BASES


2.a. Averaae Power Ranae Monitor Neutron Flux-Hich(Setdown) (continued)

For operation at low power (i.e., MODE 2), the Average PowerRange Monitor Neutron Flux-High (Setdown)Function iscapable of generating a trip signal that prevents fueldamage resulting from abnormal operating transients in thispower range. For most operation at low power levels, theAverage Power Range Monitor Neutron Flux-High (Setdown)Function will provide a secondary scram to the Wide RangeNeutron Monitor Period-Short Function because of therelative setpoints. At higher power levels, it is possiblethat the Average Power Range Monitor Neutron Flux-High(Setdown) Function will provide the primary trip signal fora corewide increase in power.

No specific safety analyses take direct credit for theAverage Power Range Monitor Neutron Flux-High (Setdown)Function. However, this Function indirectly ensures thatbefore the reactor mode switch is placed in the runposition, reactor power does not exceed 25% RTP (SL 2.1.1.1)when operating at 1ow reactor pressure and low core flow.Therefore, it indirectly prevents fuel damage duringsignificant reactivity increases with THERMAL POWER< 25% RTP.

The Allowable Value is based on preventing significantincreases in power when THERMAL POWER is < 25% RTP.

The Average Power Range Monitor Neutron Flux-High (Setdown)Function must be OPERABLE during MODE 2 when control rodsmay be withdrawn since the potential for criticality exists.In MODE 1, the Average Power Range Monitor Neutron Flux-HighFunction provides protection against reactivity transientsand the RWM and rod block monitor protect against controlrod withdrawal error events.

2.b. Averaoe Power Ranoip Monitor Simiilatec ThprmalPower-High

The Average Power Range Monitor Simulated Thermal Power-HighFunction monitors average neutron flux to approximate theTHERMAL POWER being transferred to the reactor coolant. TheAPRM neutron flux is electronically filtered with a timeconstant representative of the fuel heat transfer dynamicsto generate a signal proportional to the THERMAL POWER inthe reactor. The trip level is varied as a function ofrecirculation drive flow (i.e., at lower core flows, thesetpoint is reduced proportional to the reduction in powerexperienced as core flow is reduced with a fixed control rodattern) but is clamped at an upper limit that is alwaysower than the Average Power Range Monitor Neutron Flux-High

Function Allowable Value. A note is included, applicablewhen the plant is in single recirculation loop operation perLCO 3.4.1, which requires the flow value, used in theAllowable Value equation, be reduced by AW. The value of AW

(continued)



BASES


2.b. Average Power Range Monitor Simulated ThermalPower-High (continued)

is established to conservatively bound the inaccuracy createdin the core flow/drive flow correlation due to back flow inthe jet pumps associated with the inactive recirculationloop. The AMlowable Value thus maintains thermal marginsessentially unchanged from those for two loop operation. Thevalue of AW is plant specific and is defined in plantprocedures. The Allowable Value equation for single loopoperation is only valid for flows down to W : AW; theAllowable Value does not go below 63.7% RTP. This isacceptable because back flow in the inactive recirculationloop is only evident with drive flows of approximately 35% orgreater (Reference 19).

The Average Power Range Monitor Simulated Thermal Power-High Function is not specifically credited in the safety analysisbut is intended to provide an additional margin ofprotection from transient induced fuel damage duringoperation where recirculation flow is reduced to below theminimum required for rated power operation. The AveragePower Range Monitor Simulated Thermal Power-High Functionprovides protection against transients where THERMAL POWERincreases slowly (such as the loss of feedwater heatingevent) and protects the fuel cladding integrity by ensuringthat the MCPR SL is not exceeded. During these events., theTHERMAL POWER increase does not significantly lag theneutron flux scram. For rapid neutron flux increase events,the THERMAL POWER lags the neutron flux and the AveragePower Range Monitor Neutron Flux-High Function will providea scram signal before the Average Power Range MonitorSimulated Thermal Power-High Function setpoint is exceeded.

Each APRM channel uses one total drive flow signalrepresentative of total core flow. The total drive flowsignal is generated by the flow processing logic, part ofthe APRM channel, by summing up the flow calculated from twoflow transmitter signal inputs, one from each of the tworecirculation loop flows. The flow processing logicOPERABILITY is part of the APRM channel OPERABILITYrequirements for this Function. The APRM flow processinglogic is considered inoperable whenever it cannot deliver aflow signal less than or equal to actual Recirculation flowconditions for all steady state and transient reactorconditions while in Mode 1. Reduced or Downscale flowconditions due to planned maintenance or testing activitiesduring derated plant conditions (i.e. end of cycle coastdown) will result in conservative setpoints for the APRMSimulated Thermal Power-High function, thus maintaining thatfunction operable.

(continued)



BASES


2.b. Average Power Range Monitor Simulated ThermalPower-High (continued)

The Allowable Value is based on analyses that take creditfor the Average Power Range Monitor Simulated Thermal Power-High Function for the mitigation of non-limiting events.The THERMAL POWER time constant of < 7 seconds is based onthe fuel heat transfer dynamics and provides a signalproportional to the THERMAL POWER.

The Average Power Range Monitor Simulated Thermal Power-HighFunction is required to be OPERABLE in MODE 1 when there isthe possibility of generating excessive THERMAL POWER andpotentially exceeding the SL applicable to high pressure andcore flow conditions (MCPR SL). During MODES 2 and 5, otherWRNM and APRM Functions provide protection for fuel claddingintegrity.

2.c. Averaqe Power Ranqe Monitor Neutron Flux-Hiah

The Average Power Range Monitor Neutron Flux-High Functionis capable of generating a trip signal to prevent fueldamage or excessive RCS pressure. For theoverpressurization protection analysis of Reference 4, theAverage Power Range Monitor Neutron Flux-High Function isassumed to terminate the main steam isolation valve (MSIV)closure event and, along with the safety/relief valves(S/RVs), limit the peak reactor pressure vessel (RPV)pressure to less than the ASME Code limits. The control roddrop accident (CRDA) analysis (Ref. 5) takes credit for theAverage Power Range Monitor Neutron Flux-High Function toterminate the CRDA.

(continued)



BASES


2.c. Average Power Range Monitor Neutron Flux-High(continued)

The Allowable Value is based on the Analytical Limit assumedin the CRDA analysis.

The Average Power Range Monitor Neutron Flux-High Functionis required to be OPERABLE in MODE I where the potentialconsequences of the analyzed transients could result in theSLs (e.g., MCPR and RCS pressure) being exceeded. Althoughthe Average Power Range Monitor Neutron Flux-High Functionis assumed in the CRDA analysis, which is applicable inMODE 2, the Average Power Range Monitor Neutron Flux-High(Setdown) Function conservatively bounds the assumed tripand, together with the assumed WRNM trips, provides adequateprotection. Therefore, the Average Power Range MonitorNeutron Flux-High Function is not required in MODE 2.

(continued)



BASES

APPLICABLE 2 .f.Os i ..ionPower-- Rang.e - tQ r(PRM)---psca]eSAFETY ANALYSES,LCO, and The OPRM Upscale Function provides compliance with 10 CFRAPPLICABILITY 50, Appendix A, General Design Criteria (GDC) 10 and 12,

(continued) thereby providing protection from exceeding the fuel MCPRsafety limit (SL) due to anticipated thermal-hydraulic poweroscillations.

References 14, 15 and 16 describe three algorithms fordetecting thermal-hydraulic instability related neutron fluxoscillations: the period based detection algorithm (PBDA), theamplitude based algorithm (ABA), and the growth rate algorithm(GRA). All three are implemented in the OPRM Upscale Function,but the safety analysis takes credit only for the PBDA. Theremaining algorithms provide defense in depth and additionalprotection against unanticipated oscillations. OPRM UpscaleFunction OPERABILITY for Technical Specifications purposes isbased only on the PBDA.

The OPRM Upscale Function receives input signals from thelocal power range monitors (LPRMs) within the reactor core,which are combined into "cells" for evaluation by the OPRMalgorithms. Each channel is capable of detectingthermal-hydraulic instabilities, by detecting the relatedneutron flux oscillations, and issuing a trip signal beforethe MCPR SL is exceeded. Three of the four channels arerequired to be OPERABLE.

The OPRM Upscale trip is automatically enabled (bypassremoved) when THERMAL POWER is Ž 29.5% RTP, as indicated bythe APRM Simulated Thermal Power, and reactor core flow is< 60% of rated flow, as indicated by APRM measuredrecirculation drive flow. This is the operating region whereactual thermal-hydraulic instability and related neutron fluxoscillations may occur (Reference 18). These setpoints, whichare sometimes referred to as the "auto-bypass" setpoints,establish the boundaries of the OPRM Upscale trip enabledregion.

The OPRM Upscale Function is required to be OPERABLE when theplant is at Ž 25% RTP. The 25% RTP level is selected to providemargin in the unlikely event that a reactor power increasetransient occurring while the plant is operating below 29.5% RTPcauses a power increase to or beyond the 29.5% APRM SimulatedThermal Power OPRM Upscale trip auto-enable setpoint withoutoperator action. This OPERABILITY requirement assures that theOPRM Upscale trip auto-enable function will be OPERABLE whenrequired.

(continued)

PBAPS UNIT 2 B 3.3-12a Revision No. 50

*RPS InstrumentationB 3.3.1.1

BASES

APPLICABLE 2.d. Average Power Range Monitor-lnopSAFETY ANALYSES,LCO, and Three of the four APRM channels are required to be OPERABLEAPPLICABILITY for each of the APRM Functions. This Function (Inop)

(continued) provides assurance that the minimum number of APRM channelsare OPERABLE.

For any APRM channel, any time its mode switch is not in the"Operate" position, an APRM module required to issue a tripis unplugged, or the automatic self-test system detects acritical fault with the APRM channel, an Inop trip is sentto all four voter channels. Inop trips from two or moreunby passed APRM channels result in a trip output from eachof the four voter channels to it's associated trip system.This Function was not specifically credited in the accidentanalysis, but it is retained for the overall redundancy anddiversity of the RPS as required by the NRC approvedlicensing basis.

There is no Allowable Value for this Function.

This Function is required to be OPERABLE in the MODES wherethe APRM Functions are required.

2.e. 2-Out-Of-4 Voter

The 2-Out-Of-4 Voter Function provides the interface betweenthe APRM Functions, including the OPRM Upscale Function, andthe final RPS trip system logic. As such, it is required tobe OPERABLE in the MODES where the APRM Functions are requiredand is necessary to support the safety analysis applicable toeach of those Functions. Therefore, the 2-Out-Of-4 VoterFunction needs to be OPERABLE in MODES 1 and 2.

All four voter channels are required to be OPERABLE. Eachvoter channel includes self-diagnostic functions. If anyvoter channel detects a critical fault in its ownprocessing, a trip is issued from that voter channel to theassociated trip system.

The 2-Out-Of-4 Logic Module includes 2-Out-Of-4 Voter hardwareand the APRM Interface hardware. The 2-Out-Of-4 VoterFunction 2.e votes APRM Functions 2.a, 2.b, 2.c and 2.dindependently of Function 2.f. This voting is accomplished bythe 2-Out-Of-4 Voter hardware in the 2-Out-Of-4 Logic Module.Each 2-Out-Of-4 Voter includes two redundant sets of outputsto RPS. Each output set contains two independent contacts;one contact for Functions 2.a, 2.b, 2.c and 2.d, and the othercontact for Function 2.f. The analysis in Reference 12 tookcredit for this redundancy in the justification of the 12-hourCompletion Time for Condition A, so the voter Function 2.emust be declared inoperable if any of its functionality isinoperable. However, the voter Function 2.e does not need tobe declared inoperable due to any failure affecting only theplant interface portions of the 2-Out-Of-4 Logic Module thatare not necessary to perform the 2-Out-Of-4 Voter function.

There is no Allowable Value for this Function.(continued)



BASES

APPLICABLESAFETY ANALYSES,LCO, andAPPLICABI LITY

(continued)

2.f. Oscillation Power R a nge M on it or 0OP RM)Upscale (continued)

An OPRM Upscale trip is issued from an APRM channel whenthe PBDA in that channel detects oscillatory changes in theneutron flux, indicated by the combined signals of the LPRMdetectors in a cell, with period confirmations and relativecell amplitude exceeding specified setpoints. One or morecells in a channel exceeding the trip conditions will resultin a channel trip. An OPRM Upscale trip is also issued fromthe channel if either the GRA or ABA detects oscillatorychanges in the neutron flux for one or more cells in thatchannel.

There are four "sets" of OPRM related setpoints oradjustment parameters: a) OPRM trip auto-enable setpointsfor Simulated Thermal Power (29.5%) and drive flow (60%); b)PBDA confirmation count and amplitude setpoints; c) PBDAtuning parameters; and d) GRA and ABA setpoints.

The first set, the OPRM auto-enable region setpoints, asdiscussed in the SR 3.3.1.1.19 Bases, are treated as nominalsetpoints without the application of setpoint methodology perReference 18. The settings, 29.5% APRM Simulated Thermal Powerand 60% drive flow, are defined (limit values) in and confirmedby SR 3.3.1.1.19. The second set, the OPRM PBDA trip setpoints,are established in accordance with methodologies defined inReference 16, and are documented in the COLR. There are noTechnical Specifications allowable values for these setpoints.The third set, the OPRM PBDA "tuning" parameters, areestablished or adjusted in accordance with and controlled byPBAPS procedures. The fourth set, the GRA and ABA setpoints, inaccordance with References 14, 15 and 16, are established asnominal values only, and controlled by PBAPS procedures.

(continued)

PBAPS UNIT 2 B 3.3-12b Revision No. 50


BASES


(continued)

3. Reactor Pressure-Hiah

An increase in the RPV pressure during reactor operationcompresses the steam voids and results in a positivereactivity insertion. This causes the neutron flux andTHERMAL POWER transferred to the reactor coolant toincrease, which could challenge the integrity of the fuelcladding and the RCPB. No specific safety analysis takesdirect credit for this Function. However, the ReactorPressure-High Function initiates a scram for transientsthat result in a pressure increase, counteracting thepressure increase by rapidly reducing core power. For theoverpressurization protection analysis of Reference 4, theReactor Pressure-High Function is credited as a backupScram Function only. The analyses conservatively assume thescram occurs on the Average Power Range Monitor Scram Clampsignal, not the Reactor Pressure-High signal. The reactorscram, along with the S/RVs, limits the peak RPV pressure toless than the ASME Section III Code limits.

High reactor pressure signals are initiated from fourpressure transmitters that sense reactor pressure. TheReactor Pressure-High'Allowable Value is chosen to providea sufficient margin to the ASME Section III Code limitsduring the event.

Four channels of Reactor Pressure-High Function, with twochannels in each trip system arranged in a one-out-of-twologic, are required to be OPERABLE to ensure that no singleinstrument failure will preclude a scram from this Functionon a valid signal. The Function is required to be OPERABLEin MODES 1 and 2 when the RCS is pressurized and thepotential for pressure increase exists.

4. Reactor Vessel Water Level--Low (Level 3)

Low RPV water level indicates the capability to cool thefuel may be threatened. Should RPV water level decrease toofar, fuel damage could result. Therefore, a reactor scramis initiated at Level 3 to substantially reduce the heatgenerated in the fuel from fission. The Reactor VesselWater Level-Low (Level 3) Function is assumed in theanalysis of events resulting in the decrease of reactorcoolant inventory (Ref. 6). This is credited as a backupscram function for large and intermediate break LOCAs inside

(continued)



BASES


4. Reactor Vessel Water Level-Low (Level 3) (continued)

primary containment. The reactor scram reduces the amountof energy required to be absorbed and, along with theactions of the Emergency Core Cooling Systems (ECCS),ensures that the fuel peak cladding temperature remainsbelow the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low (Level 3) signalsinitiated from four level transmitters that sensedifference between the pressure due to a constantwater (reference leg) and the pressure due to thewater level (variable leg) in the vessel.

arethecolumn ofactual

Four channels of Reactor Vessel Water Level-Low (Level 3)Function, with two channels in each trip system arranged ina one-out-of-two logic, are required to be OPERABLE toensure that no single instrument failure will preclude ascram from this Function on a valid signal.

The Reactor Vessel Water Level-Low (Level 3) AllowableValue is selected to ensure that during normal operation theseparator skirts are not uncovered (this protects availablerecirculation pump net positive suction head (NPSH) fromsignificant carryunder) and, for transients involving lossof all normal feedwater flow, initiation of the low pressureECCS subsystems at Reactor Vessel Water-Low Low Low(Level 1) will not be required.

The Function is required in MODES I and 2 where considerableenergy exists in the RCS resulting in the limitingtransients and accidents. ECCS initiations at ReactorVessel Water Level-Low Low (Level 2) and Low Low Low(Level 1) provide sufficient protection for level transientsin all other MODES.

5. Main Steam Isolation Valve-Closure

MSIV closure results in loss of the main turbine and thecondenser as a heat sink for the nuclear steam supply systemand indicates a need to shut down the reactor to reduce heatgeneration. Therefore, a reactor scram is initiated on aMain Steam Isolation Valve-Closure signal before the MSIVsare completely closed in anticipation of the complete lossof the normal heat sink and subsequent overpressurization

(continued)



BASES


5. Main Steam Isolation Valve-Closure (continued)

transient. However, for the overpressurization protectionanalysis of Reference 4, the Average Power Range MonitorScram Clamp Function, along with the S/RVs, limits the peakRPV pressure to less than the ASME Section III Code limits.That is, the direct scram on position switches for MSIVclosure events is not assumed in the overpressurizationanalysis. The reactor scram reduces the amount of energyrequired to be absorbed and, along with the actions of theECCS, ensures that the fuel peak cladding temperatureremains below the limits of 10 CFR 50.46.

MSIV closure signals are initiated from position switcheslocated on each of the eight MSIVs. Each MSIV has twoposition switches; one inputs to RPS trip system A while theother inputs to RPS trip system B. Thus, each RPS tripsystem receives an input from eight Main Steam IsolationValve-Closure channels, each consisting of one positionswitch. The logic for the Main Steam IsolationValve-Closure Function is arranged such that either theinboard or outboard valve on three or more of the main steamlines must close in order for a scram to occur. Inaddition, certain combinations of valves closed in two lineswill result in a half-scram.

The Main Steam Isolation Valve-Closure Allowable Value isspecified to ensure that a scram occurs prior to asignificant reduction in steam flow, thereby reducing theseverity of the subsequent pressure transient.

Eight channels of the Main Steam Isolation Valve-ClosureFunction, with four channels in each trip system, arerequired to be OPERABLE to ensure that no single instrumentfailure will preclude the scram from this Function on a*valid signal. This Function is only required in MODE 1since, with the MSIVs open and the heat generation ratehigh, a pressurization transient can occur if the MSIVsclose. In MODE 2, the heat generation rate is low enough sothat the other diverse RPS functions provide sufficientprotection.

(continued)



BASES


(continued)

6. Drywell Pressure-High

High pressure in the drywell could indicate a break in theRCPB. A reactor scram is initiated to minimize thepossibility of fuel damage and to reduce the amount ofenergy being added to the coolant and the drywell. TheDrywell Pressure-High Function is assumed to scram thereactor during large and intermediate break LOCAs insideprimary containment. The reactor scram reduces the amountof energy required to be absorbed and, along with theactions of the ECCS, ensures that the fuel peak claddingtemperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from fourpressure transmitters that sense drywell pressure. TheAllowable Value was selected to be as low as possible andindicative of a LOCA inside primary containment.

Four channels of Drywell Pressure-High Function, with twochannels in each trip system arranged in a one-out-of-twologic, are required to be OPERABLE to ensure that no singleinstrument failure will preclude a scram from this Functionon a valid signal. The Function is required in MODES Iand 2 where considerable energy exists in the RCS, resultingin the limiting transients and accidents.

7. Scram Discharqe Volume Water Level--Hiqh

The SDV receives the water displaced by the motion of theCRD pistons during a reactor scram. Should this volume fillto a point where there is insufficient volume to accept thedisplaced water, control rod insertion would be hindered.Therefore, a reactor scram is initiated while the remainingfree volume is still sufficient to accommodate the waterfrom a full core scram. No credit is taken for a scraminitiated from the Scram Discharge Volume Water Level--HighFunction for any of the design basis accidents or transientsanalyzed in the UFSAR. However, this function is retainedto ensure the RPS remains OPERABLE.

(continued)



BASES

APPLICABLE 7. Scram Discharge Volume Water Level--High (continued)SAFETY ANALYSES,LCO, and SDV water level is measured by four float type levelAPPLICABILITY switches which provide four level signals. The outputs of

these devices are arranged so that one switch provides inputto one RPS logic channel. The level measurementinstrumentation satisfies the recommendations ofReference 8.

The Allowable Value is chosen low enough to ensure thatthere is sufficient volume in the SDV to accommodate thewater from a full scram.

Four high water level inputs to the RPS from four switchesare required to be OPERABLE, with two switches in each tripsystem, to ensure that no single instrument failure willpreclude a scram from this Function on a valid signal. ThisFunction is required in MODES 1 and 2, and in MODE 5 withany control rod withdrawn from a core cell containing one ormore fuel assemblies, since these are the MODES and otherspecified conditions when control rods are withdrawn. Atall other times, this Function may be bypassed.

8. Turbine Stop Valve-Closure

Closure of the TSVs results in the loss of a heat sink thatproduces reactor pressure, neutron flux, and heat fluxtransients that must be limited. Therefore, a reactor scramis initiated at the start of TSV closure in anticipation ofthe transients that would result from the closure of thesevalves. The Turbine Stop Valve-Closure Function is theprimary scram signal for the turbine trip event analyzed inReference 7 and the feedwater controller failure event. Forthese events, the reactor scram reduces the amount of energyrequired to be absorbed and ensures that the MCPR SL is notexceeded.

Turbine Stop Valve-Closure signals are initiated from fourposition switches; one located on each of the four TSVs.Each switch provides two input signals; one to RPS tripsystem A and the other, to RPS trip.system B. Thus, eachRPS trip system receives an input from four Turbine StopValve-Closure channels. The logic for the Turbine Stop

(conti.nued)



BASES


8. Turbine Stop Valve-Closure (continued)

Valve-Closure Function is such that three or more TSVs mustbe closed to produce a scram. In addition, certaincombinations of two valves closed will result in a half-scram. This Function must be enabled at THERMAL POWER

29.5% RTP as measured at the turbine first stage pressure.This is normally accomplished automatically by pressure

switches sensing turbine first stage pressure; therefore,opening of the turbine bypass valves may affect thisFunction.

The Turbine Stop Valve-Closure Allowable Value is selectedto be high enough to detect imminent TSV closure, therebyreducing the severity of the subsequent pressure transient.

Eight channels of Turbine Stop Valve-Closure Function, withfour channels in each trip system, are required to beOPERABLE to ensure that no single instrument failure willpreclude a scram from this Function if any three TSVs shouldclose. This Function is required, consistent with analysisassumptions, whenever THERMAL POWER is Ž 29.5% RTP. ThisFunction is not required when THERMAL POWER is < 29.5% RTPsince the Reactor Pressure-High and the Average Power RangeMonitor Scram Clamp Functions are adequate to maintain thenecessary safety margins.

9. Turbine Control Valve Fast Closure, Trip OilPressure-Low

Fast closure of the TCVs results in the loss of a heat sinkthat produces reactor pressure, neutron flux, and heat fluxtransients that must be limited. Therefore, a reactor scramis initiated on TCV fast closure in anticipation of thetransients that would result from the closure of thesevalves. The Turbine Control Valve Fast Closure, Trip OilPressure-Low Function is the primary scram signal for thegenerator load rejection event analyzed in Reference 7 andthe generator load rejection with bypass failure event. Forthese events, the reactor scram reduces the amount of energyrequired to be absorbed and ensures that the MCPR SL is notexceeded.

(continued)


RPSi InstrumentationB 3.3.1.1

BASES

APPLICABLESAFETY ANALYSESLCO, andAPPLICABILITY

9. Turbine Control Valve Fast Closure, Trip OilPressure-Low (continued)

Turbine Control Valve Fast Closure, Trip Oil Pressure-Lowsignals are initiated by the relayed emergency trip supplyoil pressure at each control valve. One pressure switch isassociated with each control valve, and the signal from eachswitch is assigned to a separate RPS logic channel. ThisFunction must be enabled at THERMAL POWER Ž 29.5% RTP. Thisis normally accomplished automatically by pressure switchessensing turbine first stage pressure; therefore, opening ofthe turbine bypass valves may affect this Function.

The Turbine Control Valve Fast Closure, Trip OilPressure-Low Allowable Value is selected high enough todetect imminent TCV fast closure.

Four channels of Turbine Control Valve Fast Closure, TripOil Pressure-Low Function with two channels in each tripsystem arranged in a one-out-of-two logic are required to beOPERABLE to ensure that no single instrument failure willpreclude a scram from this Function on a valid signal. ThisFunction is required, consistent with the analysisassumptions, whenever THERMAL POWER is Ž 29.5% .RTP. ThisFunction is not required when THERMAL POWER is < 29.5% RTP,since the Reactor Pressure-High and the Average Power RangeMonitor Scram Clamp Functions are adequate to maintain thenecessary safety margins.

10. Turbine Condenser-Low Vacuum

The Turbine Condenser-Low Vacuum Function protects theintegrity of the main condenser by scramming the reactor andthereby decreasing the severity of the low condenser vacuumtransient on the condenser. This function also ensuresintegrity of the reactor due to loss of its normal heatsink. The reactor scram on a Turbine Condenser-Low Vacuumsignal will occur prior to a reactor scram from a TurbineStop Valve-Closure signal. This function is notspecifically credited in any accident analysis but is beingretained for the overall redundancy and diversity of the RPSas required by the NRC approved licensing basis.

(continued)



BASES

APPLICABLE 10. Turbine Condenser-Low Vacuum (continued)SAFETY ANALYSES,LCO, and Turbine Condenser-Low Vacuum signals are initiated fromAPPLICABILITY four vacuum pressure transmitters that provide inputs to

associated trip systems. There are two trip systems and twochannels per trip system. Each trip system is arranged in aone-out-of-two logic and both trip systems must be trippedin-order to scram the reactor.

The Turbine Condenser-Low Vacuum Allowable Value isspecified to ensure that a scram occurs prior to theintegrity of the main condenser being breached, therebylimiting the damage to the normal heat sink of the reactor.

Four channels of the Turbine Condenser-Low Vacuum Functionwith two channels in each trip system, are required to beOPERABLE to ensure that no single instrument failure willpreclude a scram from this function on a valid signal. ThisFunction is only required in MODE I where considerableenergy exists which could challenge the integrity of themain condenser if vacuum is low. In MODE 2, the TurbineCondenser-Low Vacuum Function is not required because atlow power levels the transients are less severe.

11. Main Steam Line-High Radiation

Main Steam Line'High Radiation Function ensures promptreactor shutdown upon detection of high radiation in thevicinity of the main steam lines. High radiation in thevicinity of the main steam lines could indicate a gross fuelfailure in the core. The scram is initiated to limit thefission product release from the fuel. This Function is notspecifically credited in any accident analysis but is beingretained for overall redundancy and diversity of the RPS asrequired by the NRC approved licensing basis.

Main Steam Line-High Radiation signals are initiated fromfour radiation monitors. Each monitor senses high gammaradiation in the vicinity of the main steam line. The MainSteam Line-High Radiation Allowable Value is selected highenough above background radiation levels to avoid spuriousscrams, yet low enough to promptly detect a gross release offission products from the fuel.

(continued)



BASES


11. Main Steam Line-High Radiation (continued)

Four channels of Main Steam Line-High Radiation Functionwith two channels in each trip system, are required to beOPERABLE to ensure that no single instrument failure willpreclude a scram from this function on a valid signal. ThisFunction is required in MODES 1 and 2 where considerableenergy exists such that steam is being produced at a ratewhich could release considerable fission products from thefuel.

12. Reactor Mode Switch-Shutdown Position

The Reactor Mode Switch-Shutdown Position Function providessignals, via the manual scram logic channels, directly tothe scram pilot solenoid power circuits. These manual scramlogic channels are redundant to the automatic protectiveinstrumentation channels and provide manual reactor tripcapability. This Function was not specifically credited inthe accident analysis, but it is retained for the overallredundancy and diversity of the RPS as required by the NRCapproved licensing basis.

The reactor mode switch is a keylock four-position, four-bank switch. The reactor mode switch is capable ofscramming the reactor if the mode switch is placed in theshutdown position. Scram signals from the mode switch areinput into each of the two RPS manual scram logic channels.

There is no Allowable Value for this Function, since thechannels are mechanically actuated based solely on reactormode switch position.

Two channels of Reactor Mode Switch-Shutdown PositionFunction, with one channel in each manual scram trip system,are available and required to be OPERABLE. The Reactor ModeSwitch-Shutdown Position Function is required to beOPERABLE in MODES I and 2, and MODE 5 with any control rodwithdrawn from a core cell containing one or more fuelassemblies, since these are the MODES and other specifiedconditions when control rods are withdrawn.

(continued)



BASES


(continued)

13. Manual Scram

The Manual Scram push button channels provide signals, viathe manual scram logic channels, directly to the scram pilotsolenoid power circuits. These manual scram logic channelsare redundant to the automatic protective instrumentationchannels and provide manual reactor trip capability. ThisFunction was not specifically credited in the accidentanalysis but it is retained for the overall redundancy anddiversity of the RPS as required by the NRC approvedlicensing basis.

There is one Manual Scram push button channel for each ofthe two RPS manual scram logic channels. In order to causea scram it is necessary that each channel in both manualscram trip systems be actuated.

There ischannelsposition

no Allowable Value for this Function since theare mechanically actuated based solely on theof the push buttons.

Two channels of Manual Scram with one channel in each manualscram trip system are available and required to be OPERABLEin MODES 1 and 2, and in MODE 5 with any-control rodwithdrawn from a core cell containing one or more fuelassemblies, since these are the MODES and other specifiedconditions when control rods are withdrawn.

14. RPS Channel Test Switch

There are four RPS Channel Test Switches, one associatedwith each of the four automatic scram logic channels (Al,A2, BI, and B2). These keylock switches allow the operatorto test the OPERABILITY of each individual logic channelwithout the necessity of using a scram function trip. Thisis accomplished by placing the RPS Channel Test Switch intest, which will input a trip signal into the associated RPSlogic channel. The RPS Channel Test Switches were notspecifically credited in the accident analysis. However,because the Manual Scram Functions at Peach Bottom AtomicPower Station, were not configured the same as the genericmodel in Reference 9, the RPS Channel Test Switches wereincluded in the analysis in Reference 10. Reference 10concluded that the Surveillance Frequency extensions from

(continued)



BASES

APPLICABLE 14. RPS Channel Test Switch (continued)SAFETY ANALYSES,LCO, and RPS Functions, described in Reference 9, were not affectedAPPLICABILITY by the difference in configuration, since each automatic RPS

channel has a test switch which is functionally the same asthe manual scram switches in the generic model. As such,the RPS Channel Test Switches are retained in the TechnicalSpecifications.

There is no Allowable Value for this Function since thechannels are mechanically actuated based solely on theposition of the switches.

Four channels of RPS Channel Test Switch with two channelsin each trip system arranged in a one-out-of-two logic areavailable and required to be OPERABLE in MODES I and 2, andin MODE 5 with any control rod withdrawn from a core cellcontaining one or more fuel assemblies, since these are theMODES and other specified conditions when control rods arewithdrawn.

ACTIONS A Note has been provided to modify the ACTIONS related toRPS instrumentation channels. Section 1.3, CompletionTimes, specifies that once a Condition has been entered,subsequent divisions, subsystems, components, or variablesexpressed in the Condition, discovered to be inoperable ornot within limits, will not result in separate entry intothe Condition. Section 1.3 also specifies that RequiredActions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable RPS instrumentation channels provide appropriatecompensatory measures for separate inoperable channels. Assuch, a Note has been provided that allows separateCondition entry for each inoperable RPS instrumentationchannel.

A.1 and A.2

Because of the diversity of sensors available to providetrip signals and the redundancy of the RPS design, anallowable out of service time of 12 hours has been shown tobe acceptable (Refs. 9, 12 & 13) to permit restoration ofany inoperable channel to OPERABLE status. However, thisout of service time is only acceptable provided theassociated

(continued)



BASES


Function's inoperable channel is in one trip system and theFunction still maintains RPS trip capability (refer toRequired Actions B.1, B.2, and C.1 Bases). If theinoperable channel cannot be restored to OPERABLE statuswithin the allowable out of service time, the channel or theassociated trip system must be placed in the trippedcondition per Required Actions A.1 and A.2. Placing theinoperable channel in trip (or the associated trip system intrip) would conservatively compensate for the inoperability,restore capability to accommodate a single failure, andallow operation to continue. Alternatively, if it is notdesired to place the channel (or trip system) in trip (e.g.,as in the case where placing the inoperable channel in tripwould result in a full scram), Condition D must be enteredand its Required Action taken.

As noted, Action A.2 is not applicable for APRM Functions2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of one requiredAPRM channel affects both trip systems. For that condition,Required Action A.1 must be satisfied, and is the onlyaction (other than restoring operability) that will restorecapability to accommodate a single failure. Inoperabilityof more than one required APRM channel of the same tripfunction results in loss of trip capability and entry intoCondition C, as well as entry into Condition A for eachchannel.

B.1 and B.2

Condition B exists when, for any one or more Functions, atleast one required channel is inoperable in each tripsystem. In this condition, provided at least one channelper trip system is OPERABLE, the RPS still maintains tripcapability for that Function, but cannot accommodate asingle failure in either trip system.

Required Actions B.1 and B.2 limit the time the RPS scramlogic, for any Function, would not accommodate singlefailure in both trip systems (e.g., one-out-of-one andone-out-of-one arrangement for a typical four channelFunction). The reduced reliability of this logicarrangement was not evaluated in References 9, 12 or 13 forthe 12 hour Completion Time. Within the 6 hour allowance,the associated Function will have all required channelsOPERABLE or in trip (or any combination) in one trip system.



BASES


Completing one of these Required Actions restores RPS to areliability level equivalent to that evaluated inReferences 9, 12 or 13, which justified a 12 hour allowableout of service time as presented in Condition A. The tripsystem in the more degraded state should be placed in tripor, alternatively, all the inoperable channels in that tripsystem should be placed in trip (e.g., a trip system withtwo inoperable channels could be in a more degraded statethan a trip system with four inoperable channels if the twoinoperable channels are in the same Function while the fourinoperable channels are all in different Functions). Thedecision of which trip system is in the more degraded stateshould be based on prudent judgment and take into accountcurrent plant conditions (i.e., what MODE the plant is in).If this action would result in a scram or RPT, it ispermissible to place the other trip system or its inoperablechannels in trip.

The 6 hour Completion Time is judged acceptable based on theremaining capability to trip, the diversity of the sensorsavailable to provide the trip signals, the low probabilityof extensive numbers of inoperabilities affecting alldiverse Functions, and the low probability of an eventrequiring the initiation of a scram.

Alternately, if it is not desired to place the inoperablechannels (or one trip system) in trip (e.g., as in the casewhere placing the inoperable channel or associated tripsystem in trip would result in a scram, Condition D must beentered and its Required Action taken.

As noted, Condition B is not applicable for APRM Functions2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of an APRMchannel affects both trip systems and is not associated witha specific trip system as are the APRM 2-Out-Of-4 voter andother non-APRM channels for which Condition B applies. Foran inoperable APRM channel, Required Action A.1 must besatisfied, and is the only action (other than restoringoperability) that will restore capability to accommodate asingle failure. Inoperability of a Function in more thanone required APRM channel results in loss of trip capabilityfor that Function and entry into Condition C, as well asentry into Condition A for each channel. Because ConditionA and C provide Required Actions that are appropriate forthe inoperability of APRM Functions 2.a, 2.b, 2.c, 2.d, or2.f, and these functions are not associated with specifictrip systems as are the APRM 2-Out-Of-4 voter and other non-APRM channels, Condition B does not apply.

(continued)



BASES

ACTIONS C.1(continued)

Required Action C.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same trip system for the same Functionresult in an automatic Function, or two or more manualFunctions, not maintaining RPS trip capability. A Functionis considered to be maintaining RPS trip capability whensufficient channels are OPERABLE or in trip (or theassociated trip system is in trip), such that both tripsystems will generate a trip signal from the given Functionon a valid signal. For the typical Function with one-out-of-two taken twice logic and the IRM and APRM Functions,this would require both trip systems to have one channelOPERABLE or in trip (or the associated trip system in trip).For Function 5 (Main Steam Isolation Valve-Closure), thiswould require both trip systems to have each channelassociated with the MSIVs in three main steam lines (notnecessarily the same main steam lines for both tripsystems)OPERABLE or in trip (or the associated trip systemin trip). For Function 8 (Turbine Stop Valve-Closure),this would require both trip systems to have three channels,each OPERABLE or in trip (or the associated trip system in Wtrip). For Functions 12 (Reactor Mode Switch-ShutdownPosition) and 13 (Manual Scram), this would require bothtrip systems to have one channel, each OPERABLE or in trip(or the associated trip system in trip).

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. The1 hour Completion Time is acceptable because it minimizesrisk while allowing time for restoration or tripping ofchannels.

D.1

Required Action D.1 directs entry into the appropriateCondition referenced in Table 3.3.1.1-1. The applicablecondition specified in the Table is Function and MODE orother specified condition dependent and may change as theRequired Action of a previous Condition is completed. Eachtime an inoperable channel has not met any Required Actionof Condition A, B, or C and the associated Completion Timehas expired, Condition D will be entered for that channeland provides for transfer to the appropriate subsequentCondition.

(continued)



BASES

ACTIONS E.1. F.1. G.1. and J.1(continued)

If the channel(s) is not restored to OPERABLE status orplaced in trip (or the associated trip system placed intrip) within the allowed Completion Time, the plant must beplaced in a MODE or other specified condition in which theLCO does not apply. The allowed Completion Times arereasonable, based on operating experience, to reach thespecified condition from full power conditions in an orderlymanner and without challenging plant systems. In addition,the Completion Time of Required Actions E.1 and J.1 areconsistent with the Completion Time provided in LCO 3.2.2,"MINIMUM CRITICAL POWER RATIO (MCPR)."

H.1

If the channel(s) is not restored to OPERABLE status orplaced in trip (or the associated trip system placed intrip) within the allowed Completion Time, the plant must beplaced in a MODE or other specified condition in which theLCO does not apply. This is done by immediately initiatingaction to fully insert all insertable control rods in corecells containing one or more fuel assemblies. Control rodsin core cells containing no fuel assemblies do not affectthe reactivity of the core and are, therefore, not requiredto be inserted. Action must continue until all insertablecontrol rods in core cells containing one or more fuelassemblies are fully inserted.

I.1

If OPRM Upscale trip capability is not maintained, ConditionI exists. References 12 and 13 justified use of alternatemethods to detect and suppress oscillations for a limitedperiod of time. The alternate methods are procedurallyestablished consistent with the guidelines identified inReference 17 requiring manual operator action to scram theplant if certain predefined events occur. The 12-hourallowed Completion Time for Required Action 1.1 is based onengineering judgment to allow orderly transition to thealternate methods while limiting the period of time duringwhich no automatic or alternate detect and suppress tripcapability is formally in place. Based on the smallprobability of an instability event occurring at all, the 12hour duration is judged to be reasonable.

The 12 hour Completion Time of 1.1 is provided to establishthe alternate detect and suppress method regardless ofwhether the 120 day Completion Time of 1.2 applies. If theinoperable condition is such that action 1.2 does not apply,then Condition J is entered once Required Action 1.1 hasbeen completed or once the Completion Time of RequiredAction 1.1 has expired.

(continued)



BASES

ACTIONS 1.2(continued)

The alternate method to detect and suppress oscillationsimplemented in accordance with 1.1 was evaluated (References12 and 13) based on use up to 120 days only. The evaluation,based on engineering judgment, concluded that the likelihoodof an instability event that could not be adequately handledby the alternate methods during this 120-day period wasnegligibly small. The 120-day period is intended to be anoutside limit to allow for the case where design changes orextensive analysis might be required to understand or correctsome unanticipated characteristic of the instabilitydetection algorithms or equipment. This action is notintended and was not evaluated as a routine alternative toreturning failed or inoperable equipment to OPERABLE status.Correction of routine equipment failure or inoperability isexpected to normally be accomplished within the completiontimes allowed for Actions for Condition A.

The 12 hour Completion Time of 1.1 is provided to establishthe alternate detect and suppress method regardless ofwhether the 120 day Completion Time of 1.2 applies. If theinoperable condition is such that action 1.2 does not apply,then Condition J is entered once Required Action 1.1 hasbeen completed or once the Completion Time of RequiredAction 1.1 has expired.

A note is provided to indicate that LCO 3.0.4 is notapplicable. The intent of that note is to allow plant startupwhile operating within the 120-day completion time for action1.2. The primary purpose of this exclusion is to allow anorderly completion of design and verification activities, inthe event of a required design change, without undue impacton plant operation.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPSREQUIREMENTS instrumentation Function are located in the SRs column of

Table 3.3.1.1-1.

The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may be delayed for up to6 hours, provided the associated Function maintains RPS tripcapability. Upon completion of the Surveillance, orexpiration of the 6 hour allowance, the channel must bereturned to OPERABLE status or the applicable Conditionentered and Required Actions taken. This Note is based onthe reliability analysis (Refs. 9, 12 & 13) assumption ofthe average time required to perform channel Surveillance.That analysis demonstrated that the 6 hour testing allowancedoes not significantly reduce the probability that the RPSwill trip when necessary.

(continued)



BASES


(continued)

SR 3.3.1.1.1

Performance of the CHANNEL CHECK once every 12 hour's ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff basedon a combination of the channel instrument uncertainties,including indication and readability. If a channel isoutside the criteria, it may be an indication that theinstrument has drifted outside its limit.

The Frequency is based upon operating experience thatdemonstrates channel failure is rare. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannels during normal operational use of the displaysassociated with the channels required by the LCO.

SR 3.3.1.1.2

To ensure that the APRMs are accurately indicating the truecore average power, the APRMs are calibrated to the reactorpower calculated from a heat balance. The Frequency of onceper 7 days is based on minor changes in LPRM sensitivity,which could affect the APRM reading between performances ofSR 3.3.1.1.8.

(con tinued)



BASES

SURVEILLANCE SR 3.3.1.1.2 (continued)REQUIREMENTS

A restriction to satisfying this SR when < 25% RTP isprovided that requires the SR to be met only at 2 25% RTPbecause it is difficult to accurately maintain APRMindication of core THERMAL POWER consistent with a heatbalance when < 25% RTP. At low power levels, a high degreeof accuracy is unnecessary because of the large, inherentmargin to thermal limits (MCPR, LHGR and APLHGR). At Ž 25%RTP, the Surveillance is required to have been satisfactorilyperformed within the last 7 days, in accordance withSR 3.0.2. A Note is provided which allows an increase inTHERMAL POWER above 25% if the 7 day Frequency is not metper SR 3.0.2. In this event, the SR must be performedwithin 12 hours after reaching or exceeding 25% RTP. Twelvehours is based on operating experience and in considerationof providing a reasonable time in which to complete the SR.

SR 3.3.1.1.3

(Not Used.)

SR 3.3.1.1.4

A CHANNEL FUNCTIONAL TEST is performed on each required.channel to ensure that the entire channel will perform theintended function. A Frequency of 7 days provides anacceptable level of system average availability over theFrequency and is based on the reliability analysis ofReferences 9 and 10. (The RPS Channel Test SwitchFunction's CHANNEL FUNCTIONAL TEST Frequency was credited inthe analysis to extend many automatic scram Functions'Frequencies.)

SR 3.3.1.1.5 and SR 3.3.1.1.6

A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function. Any setpoint adjustment shall be madeconsistent with the assumptions of the current plantspecific setpoint methodology.

(continued)



BASES


SR 3.3.1.1.5 and SR 3.3.1.1.6 (continued)

As noted, SR 3.3.1.1.5 is not required to be performed whenentering MODE 2 from MODE 1, since testing of the MODE 2required WRNM Functions cannot be performed in MODE 1without utilizing jumpers, lifted leads, or movable links.This allows entry into MODE 2 if the 31 day Frequency is notmet per SR 3.0.2. In this event, the SR must be performedwithin 12 hours after entering MODE 2 from MODE 1. Twelvehours is based on operating experience and in considerationof providing a reasonable time in which to complete the SR.

A Frequency of 31 days provides an acceptable level ofsystem average unavailability over the Frequency intervaland is based on fixed incore detectors, overall reliability,and self-monitoring features.

SR 3.3.1.1.7

(Not Used.)

(continued)



BASES

SURVEILLANCE SR 3.3.1.1.8REQUIREMENTS

(continued) LPRM gain settings are determined from the local fluxprofiles measured by the Traversing Incore Probe (TIP)System. This establishes the relative local flux profilefor appropriate representative input to the APRM System.The 1000 MWD/T Frequency is based on operating experiencewith LPRM sensitivity changes.

SR 3.3.1.1.9 and SR 3.3.1.1.14

A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function. Any setpoint adjustment shall beconsistent with the assumptions of the current plantspecific setpoint methodology. For Function 5, 7, and 8channels, verification that the trip settings are less thanor equal to the specified Allowable Value during the CHANNELFUNCTIONAL TEST is not required since the channels consistof mechanical switches and are not subject to drift. Anexception to this are two of the Function 7 level switcheswhich are not mechanical. These Scram Discharge Volume(SDV) RPS switches (Fluid Components Inc.) are heatsensitive electronic level detectors which actuate bysensing a difference in temperature. The temperaturedetectors are permanently affixed within the scram dischargevolume piping conservatively below the level (allowablevalue as measured in gallons) at which an RPS actuationsignal will occur. Since there is no drift involved withthe physical location of these switches, verifying the tripsettings are less than or equal to the specified allowablevalue during the CHANNEL FUNCTIONAL TEST is not required.Additionally, historical calibration data has indicated thatthe FCI level switches have not exceeded their AllowableValue when tested.

(continued)



BASES

SURVEILLANCE SR 3.3.1.1.9 and SR 3.3.1.1.14 (continued)REQUIREMENTS

In addition, Function 5 and 7 instruments are not accessiblewhile the unit is operating at power due to high radiationand the installed indication instrumentation does notprovide accurate indication of the trip setting. For theFunction 9 channels, verification that the trip settings areless than or equal to the specified Allowable Value duringthe CHANNEL FUNCTIONAL TEST is not required since theinstruments are not accessible while the unit is operatingat power due to high radiation and the installed indicationinstrumentation does not provided accurate indication of thetrip setting. Waiver of these verifications for the abovefunctions is considered acceptable since the magnitude ofdrift assumed in the setpoint calculation is based on a 24month calibration interval. The 92 day Frequency ofSR 3.3.1.1.9 is based on the reliability analysis ofReference 9.

The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown that these components willpass the Surveillance when performed at the 24 monthFrequency.

SR 3.3.1.1.10, SR 3.3.1.1.12, SR 3.3.1.1.15,and SR 3.3.1.1.16

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies that the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the current plant specificsetpoint methodology.

As noted for SR 3.3.1.1.10, radiation detectors are excludedfrom CHANNEL CALIBRATION due to ALARA reasons (when the plantis operating, the radiation detectors are generally in a highradiation area; the steam tunnel). This exclusion isacceptable because the radiation detectors are passivedevices, with minimal drift. To complete the radiationCHANNEL CALIBRATION, SR 3.3.1.1.16 requires that theradiation detectors be calibrated on a once per 24 monthsFrequency.

The once per 92 days Frequency of SR 3.3.1.1.10 isconservative with respect to the magnitude of equipment driftassumed in the setpoint analysis. The Frequency ofSR 3.3.1.1.16 is based upon the assumption of a 24-monthcalibration interval used in the determination of theequipment drift in the setpoint analysis.

As noted for SR 3.3.1.1.12, neutron detectors are excludedfrom CHANNEL CALIBRATION because they are passive devices,with minimal drift, and because of the difficulty ofsimulating a meaningful signal. Changes in

(continued)



BASES

SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.12, SR 3.3.1.1.15,REQUIREMENTS and SR 3.3.1.1.16 (continued)

neutron detector sensitivity are compensated for byperforming the 7 day calorimetric calibration (SR 3.3.1.1.2)and the 1000 MWD/T LPRM calibration against the TIPs(SR 3.3.1.1.8).

A second note is provided for SR 3.3.1.1.12 that allows theWRNM SR to be performed within 12 hours of entering MODE 2from MODE 1. Testing of the MODE 2 WRNM Functions cannot beperformed in MODE 1 without utilizing jumpers, lifted leadsor movable links. This Note allows entry into MODE 2 fromMODE 1, if the 24 month Frequency is not met per SR 3.0.2.Twelve hours is based on operating experience and inconsideration of providing a reasonable time in which tocomplete the SR.

A third note is provided for SR 3.3.1.1.12 that includes inthe SR the recirculation flow (drive flow) transmitters,which supply the flow signal to the APRMs. The APRM SimulatedThermal Power-High Function (Function 2.b) and the OPRMUpscale Function (Function 2.f), both require a valid driveflow signal. The APRM Simulated Thermal Power-High Functionuses drive flow to vary the trip setpoint. The OPRM UpscaleFunction uses drive flow to automatically enable or bypassthe OPRM Upscale trip output to RPS. A CHANNEL CALIBRATION ofthe APRM drive flow signal requires both calibrating thedrive flow transmitters and establishing a valid drive flow /core flow relationship. The drive flow /core flowrelationship is established once per refuel cycle, whileoperating at or near rated power and flow conditions. Thismethod of correlating core flow and drive flow is consistentwith GE recommendations. Changes throughout the cycle in thedrive flow / core flow relationship due to the changingthermal hydraulic operating conditions of the core areaccounted for in the margins included in the bases oranalyses used to establish the setpoints for the APRMSimulated Thermal Power-High Function and the OPRM UpscaleFunction.

The Frequencies of SR 3.3.1.1.12 and SR 3.3.1.1.15 are basedupon the assumption of a 24-month calibration interval usedin the determination of the equipment drift in the setpointanalysis.

SR 3.3.1.1.11

A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform the

(continued) A



BASES


intended function. For the APRM Functions, this testsupplements the automatic self-test functions that operatecontinuously in the APRM and voter channels. The scope ofthe APRM CHANNEL FUNCTIONAL TEST is limited to verificationof system trip output hardware. Software controlledfunctions are tested only incidentally. Automatic internalself-test functions check the EPROMs in which the software-controlled logic is defined. Any changes in the EPROMs willbe detected by the self-test function resulting in a tripand/or alarm condition. The APRM CHANNEL FUNCTIONAL TESTcovers the APRM channels (including recirculation flowprocessing - applicable to Function 2.b and the auto-enableportion of Function 2.f only), the 2-Out-Of 4 voterchannels, and the interface connections into the RPS tripsystems from the voter channels. Any setpoint adjustmentshall be consistent with the assumptions of the currentplant specific setpoint methodology. The 184 day Frequencyof SR 3.3.1.1.11 is based on the reliability analyses ofReferences 12 and 13. (NOTE: The actual voting logic of the2-Out-Of-4 Voter Function is tested as part of SR3.3.1.1.17. The actual auto-enable setpoints for the OPRMUpscale trip are confirmed by SR 3.3.1.1.19.)

A Note is provided for Function 2.a that requires this SR tobe performed within 12 hours of entering MODE 2 from MODE 1.Testing of the MODE 2 APRM Function cannot be performed inMODE 1 without utilizing jumpers or lifted leads. This Noteallows entry into MODE 2 from MODE 1 if the associatedFrequency is not met per SR 3.0.2.

A second Note is provided for Function 2.b that clarifiesthat the CHANNEL FUNCTIONAL TEST for Function 2.b includestesting of the recirculation flow processing electronics,excluding the flow transmitters.

SR 3.3.1.1.13

This SR ensures that scrams initiated from the Turbine StopValve-Closure and Turbine Control Valve Fast Closure, TripOil Pressure-Low Functions will not be inadvertentlybypassed when THERMAL POWER is Ž 29.5% RTP. This involvescalibration of the bypass channels. Adequate margins forthe instrument setpoint methodologies are incorporated intothe Allowable Value (• 28.9% RTP which is equivalent to• 138.4 psig as measured from turbine first stage pressure)and the actual setpoint. Because main turbine bypass flowcan affect this setpoint nonconservatively (THERMAL POWERis derived from turbine first stage pressure), the mainturbine bypass valves must remain closed during thecalibration at THERMAL POWER Ž 29.5% RTP to ensure that thecalibration is valid.

If any bypass channel's setpoint is nonconservative (i.e.,the Functions are bypassed at Ž 29.5% RTP, either due to openmain turbine bypass valve(s) or other reasons), then the

(continued)



BASES


affected Turbine Stop Valve-Closure and Turbine ControlValve Fast Closure, Trip Oil Pressure-Low Functions areconsidered inoperable. Alternatively, the bypass channelcan be placed in the conservative condition (nonbypass). Ifplaced in the nonbypass condition, this SR is met and thechannel is considered OPERABLE.

The Frequency of 24 months is based on engineering judgmentand reliability of the components.

SR 3.3.1.1.17

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required trip logic for a specificchannel. The functional testing of control rods(LCO 3.1.3), and SDV vent and drain valves (LCO 3.1.8),overlaps this Surveillance to provide complete testing ofthe assumed safety function.


The LOGIC SYSTEM FUNCTIONAL TEST for APRM Function 2.esimulates APRM and OPRM trip.conditions at the 2-Out-Of-4voter channel inputs to check all combinations of twotripped inputs to the 2-Out-Of-4 logic in the voter channelsand APRM related redundant RPS relays.

SR 3.3.1.1.18

This SR ensures that the individual channel response timesare maintained less than or equal to the original designvalue. The RPS RESPONSE TIME acceptance criterion isincluded in Reference 11.

RPS RESPONSE TIME tests are conducted on a 24 monthFrequency. The 24 month Frequency is consistent with thePBAPS refueling cycle and is based upon plant operatingexperience, which shows that random failures ofinstrumentation components causing serious response timedegradation, but not channel failure, are infrequentoccurrences.



BASES

SURVEILLANCEREOUIREMENTS

(continued)

SR 3.3.1.1.19

This surveillance involves confirming the OPRM Upscale tripauto-enable setpoints. The auto-enable setpoint values areconsidered to be nominal values as discussed in Reference 18.This surveillance ensures that the OPRM Upscale trip isenabled (not bypassed) for the correct values of APRMSimulated Thermal Power and recirculation drive flow. Othersurveillances ensure that the APRM Simulated Thermal Powerand recirculation drive flow properly correlate with THERMALPOWER (SR 3.3.1.1.2) and core flow (SR 3.3.1.1.12),respectively.

The Frequency of 24 months is based on engineering judgmentand reliability of the components.

REFERENCES 1. UFSAR, Section 7.2.


3. NEDO-32368, "Nuclear Measurement Analysis and ControlWide Range Neutron Monitoring System Licensing Reportfor Peach Bottom Atomic Power Station, Units 2 and 3,"November 1994.

4. NEDC-32183P, "Power Rerate Safety Analysis Report for

Peach Bottom 2 & 3," dated May 1993.




8. P. Check (NRC) letter to G. Lainas (NRC), "BWR ScramDischarge System Safety Evaluation," December 1, 1980.

9. NEDO-30851-P-A, "Technical Specification ImprovementAnalyses for BWR Reactor Protection System," March 1988.

(continued)



BASES

REFERENCES 10. MDE-87-0485-1, "Technical Specification Improvement(continued) Analysis for the Reactor Protection System for Peach

Bottom Atomic Power Station Units 2 and 3," October1987.


12. NEDC-32410P-A, "Nuclear Measurement Analysis andControl Power Range Neutron Monitor (NUMAC PRNM)Retrofit Plus Option III Stability Trip Function",October 1995.

13. NEDC-32410P Supplement 1, "Nuclear MeasurementAnalysis and Control Power Range Neutron Monitor(NUMAC PRNM) Retrofit Plus Option III Stability TripFunction, Supplement 1", November 1997.

14. NEDO-31960-A, "BWR Owners' Group Long-Term StabilitySolutions Licensing Methodology," November 1995.

15. NEDO-31960-A, Supplement 1, "BWR Owners' Group Long-TermStability Solutions Licensing Methodology," November1995.

16. NEDO-32465-A, "Reactor Stability Detect and SuppressSolutions Licensing Basis Methodology And ReloadApplications," August 1996.

17. Letter, L. A. England (BWROG) to M. J. Virgilio, "BWROwners' Group Guidelines for Stability InterimCorrective Action," June 6, 1994.

18. BWROG Letter 96113, K. P. Donovan (BWROG) to L. E.Phillips (NRC), "Guidelines for Stability Option III'Enable Region' (TAC M92882)," September 17, 1996.

19. NEDO-24229-1, "Peach Bottom Atomic Power Station Units 2and 3 Single-Loop Operation," May 1980.


WRNM Instrumentation

B 3.3.1.2


B 3.3.1.2 Wide Range Neutron Monitor (WRNM) Instrumentation

BASES

BACKGROUND The WRNMs are capable of providing the operator withinformation relative to the neutron flux level at very lowflux levels in the core. As such, the WRNM indication is

used by the operator to monitor the approach to criticalityand determine when criticality is achieved.

The WRNM subsystem of the Neutron Monitoring System (NMS)consists of eight channels. Each of the WRNM channels canbe bypassed, but only one at any given time per RPS tripsystem, by the operation of a bypass switch. Each channel

includes one detector that is permanently positioned in thecore. Each detector assembly consists of a miniaturefission chamber with associated cabling, signal conditioningequipment, and electronics associated with the various WRNMfunctions. The signal conditioning equipment converts the

current pulses from the fission chamber to analog DCcurrents that correspond to the count rate. Each channelalso includes indication, alarm, and control rod blocks.However, this LCO specifies OPERABILITY requirements onlyfor the monitoring and indication functions of the WRNMs.

During refueling, shutdown, and low power operations, theprimary indication of neutron flux levels is provided by theWRNMs or special movable detectors connected to the normalWRNM circuits. The WRNMs provide monitoring of reactivitychanges during fuel or control rod movement and give thecontrol room operator early indication of unexpectedsubcritical multiplication that could be indicative of anapproach to criticality.

APPLICABLE Prevention and mitigation of prompt reactivity excursionsSAFETY ANALYSES during refueling and low power operation is provided by

LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1,"SHUTDOWN MARGIN (SDM)"; LCO 3.3.1.1, "Reactor ProtectionSystem (RPS) Instrumentation"; WRNM Period-Short and

(continued)


WRNM InstrumentationB 3.3.1.2

BASES

APPLICABLE Average Power Range Monitor (APRM) Startup High Flux ScramSAFETY ANALYSES Functions; and LCO 3.3.2.1, "'Control Rod Block

(continued) Instrumentation."

The WRNMs have no safety function associated with monitoringneutron flux at very low levels and are not assumed tofunction during any UFSAR design basis accident or transientanalysis which would occur at very low neutron flux levels.However, the WRNMs provide the only on-scale monitoring ofneutron flux levels during startup and refueling.Therefore, they are being retained in TechnicalSpecifications.

LCO During startup in MODE 2, three of the eight WRNM channelsare required to be OPERABLE to monitor the reactor fluxlevel and reactor period prior to and during control rodwithdrawal, subcritical multiplication and reactorcriticality. These three required channels must be locatedin different core quadrants in order to provide arepresentation of the overall core response during thoseperiods when reactivity changes are occurring throughout thecore.

In MODES 3 and 4, with the reactor shut down, two WRNMchannels provide redundant monitoring of flux levels in thecore.

In MODE 5, during a spiral offload or reload, a WRNM outsidethe fueled region will no longer be required to be OPERABLE,since it is not capable of monitoring neutron flux in thefueled region of the core. Thus, CORE ALTERATIONS areallowed in a quadrant with no OPERABLE WRNM in an adjacentquadrant provided the Table 3.3.1.2-1, footnote (b),requirement that the bundles being spiral reloaded or spiraloffloaded are all in a single fueled region containing atleast one OPERABLE WRNM is met. Spiral reloading andoffloading encompass reloading or offloading a cell on theedge of a continuous fueled region (the cell can be reloadedor offloaded in any sequence).

In nonspiral routine operations, two WRNMs are required tobe OPERABLE to provide redundant monitoring of reactivitychanges in the reactor core. Because of the local nature ofreactivity changes during refueling, adequate coverage isprovided by requiring one WRNM to be OPERABLE for theconnected fuel in the quadrant of the reactor core where

(continued)



BASES

LCO(continued)

CORE ALTERATIONS are being performed. There are two WRNMsin each quadrant. Any CORE ALTERATIONS must be performed ina region of fuel that is connected to an OPERABLE WRNM toensure that the reactivity changes are monitored within thefueled region(s) of the quadrant. The other WRNM that isrequired to be OPERABLE must be in an adjacent quadrantcontaining fuel. These requirements ensure that thereactivity of the core will be continuously monitored duringCORE ALTERATIONS.

Special movable detectors, according to footnote (c) ofTable 3.3.1.2-1, may be used in place of the normal WRNMnuclear detectors. These special detectors must beconnected to the normal WRNM circuits in-the NMS, such thatthe applicable neutron flux indication can be generated.These special detectors provide more flexibility inmonitoring reactivity changes during fuel loading, sincethey can be positioned anywhere with in the core duringrefueling. They must still meet the location requirementsof SR 3.3.1.2.2 and all other required SRs for WRNMs.

The Table 3.3.1.2-1, footnote (d), requirement provides forconservative spatial core coverage.

For a WRNM channel to be considered OPERABLE, it must beproviding neutron flux monitoring indication.

APPLICABILITY The WRNMs are required to be OPERABLE in MODES 2, 3, 4,and 5 prior to the WRNMs reading 125E-5 % power to providefor neutron monitoring. In MODE 1, the APRMs provideadequate monitoring of reactivity changes in the core;therefore, the WRNMs are not required. In MODE 2, withWRNMs reading greater than 125E-5 % power, the WRNM Period-Short function provides adequate monitoring and the WRNMsmonitoring indication is not required.

ACTIONS A.] and B.1

In MODE 2, the WRNM channels provide the means of monitoringcore reactivity and criticality. With any number of therequired WRNMs inoperable, the ability to monitor neutronflux is degraded. Therefore, a limited time is allowed torestore the inoperable channels to OPERABLE status.

Provided at least one WRNM remains OPERABLE, RequiredAction A.1 allows 4 hours to restore the required WRNMs toOPERABLE status. This time is reasonable because there isadequate capability remaining to monitor the core, there islimited risk of an event during this time, and there issufficient time to take corrective actions to restore therequired WRNMs to OPERABLE status. During this time,control rod withdrawal and power increase is not precluded

(continued)PBAS UIT B3.33.8Reiso No..... 24



BASES

ACTIONS A.1 and B.1 (continued)

by this Required Action. Having the ability to monitor thecore with at least one WRNM, proceeding to WRNM indicationgreater than 125E-5 % power, and thereby exiting theApplicability of this LCO, is acceptable for ensuringadequate core monitoring and allowing continued operation.

With three required WRNMs inoperable, Required Action B.1allows no positive changes in reactivity (control rodwithdrawal must be immediately suspended) due to inabilityto monitor the changes. Required Action-A.1 still appliesand allows 4 hours to restore monitoring capability prior torequiring control rod insertion. This allowance is based onthe limited risk of an event during this time, provided thatno control rod withdrawals are allowed, and the desire toconcentrate efforts on repair, rather than to immediatelyshut down, with no WRNMs OPERABLE.

C.'

In MODE 2, if the required number of WRNMs is not restoredto OPERABLE status within the allowed Completion Time, thereactor shall be placed in MODE 3. With all control rodsfully inserted, the core is in its least reactive state withthe most margin to criticality. The allowed Completion Timeof 12 hours is reasonable, based on operating experience, toreach MODE 3 from full power conditions in an orderly mannerand without challenging plant systems.

D.1 and D.2

With one or more required WRNMs inoperable in MODE 3 or 4,the neutron flux monitoring capability is degraded ornonexistent. The requirement to fully insert all insertablecontrol rods ensures that the reactor will be at its minimumreactivity level while no neutron monitoring capability isavailable. Placing the reactor mode switch in the shutdownposition prevents subsequent control rod withdrawal bymaintaining a control rod block. The allowed CompletionTime of I hour is sufficient to accomplish the RequiredAction, and takes into account the low probability of anevent requiring the WRNM occurring during this interval.

(continued)



BASES

ACTIONS E.1 and E.2(continued)

With one or more required WRNMs inoperable in MODE 5, theability to detect local reactivity changes in the coreduring refueling is degraded. CORE ALTERATIONS must beimmediately suspended and action must be immediatelyinitiated to fully insert all insertable control rods incore cells containing one or more fuel assemblies.Suspending CORE ALTERATIONS prevents the two most probablecauses of reactivity changes, fuel loading and control rodwithdrawal, from occurring. Inserting all insertablecontrol rods ensures that the reactor will be at its minimumreactivity given that fuel is present in the core.Suspension of CORE ALTERATIONS shall not preclude completionof the movement of a component to a safe, conservativeposition.

Action (once required to be initiated) to insert controlrods must continue until all insertable rods in core cellscontaining one or more fuel assemblies are inserted.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each WRNMREQUIREMENTS Applicable MODE or other specified conditions are found in

the SRs column of Table 3.3.1.2-1.

SR 3.3.1.2.1 and SR 3.3.1.2.3

Performance of the CHANNEL CHECK ensures that a grossfailure of instrumentation has not occurred. A CHANNELCHECK is normally a comparison of the parameter indicated onone channel to a similar parameter on another channel. Itis based on the assumption that instrument channelsmonitoring the same parameter should read approximately thesame value. Significant deviations between the instrumentchannels could be an indication of excessive instrumentdrift in one of the channels or something even more serious.A CHANNEL CHECK will detect gross channel failure; thus, itis key to verifying the instrumentation continues to operateproperly between each CHANNEL CALIBRATION.


(continued)



BASES


The Frequency of once every 12 hours for SR 3.3.1.2.1 isbased on operating experience that demonstrates channelfailure is rare. While in MODES 3 and 4, reactivity changesare not expected; therefore, the 12 hour Frequency isrelaxed to 24 hours for SR 3.3.1.2.3. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannels during normal operational use of the displaysassociated with the channels required by the LCO.

SR 3.3.1.2.2

To provide adequate coverage of potential reactivity changesin the core, one WRNM is required to be OPERABLE for theconnected fuel in the quadrant where CORE ALTERATIONS arebeing performed, and the other OPERABLE WRNM must be in anadjacent quadrant containing fuel. Note 1 states that theSR is required to be met only during CORE ALTERATIONS. Itis not required to be met at other times in MODE 5 sincecore reactivity changes are not occurring. ThisSurveillance consists of a review of plant logs to ensurethat WRNMs required to be OPERABLE for given COREALTERATIONS are, in fact, OPERABLE. In the event that onlyone WRNM is required to be OPERABLE, per Table 3.3.1.2-1,footnote (b), only the a. portion of this SR is required.Note 2 clarifies that more than one of the threerequirements can be met by the same OPERABLE WRNM. The12 hour Frequency is based upon operating experience andsupplements operational controls over refueling activitiesthat include steps to ensure that the WRNMs required by theLCO are in the proper quadrant.

SR 3.3.1.2.4

This Surveillance consists of a verification of the WRNMinstrument readout to ensure that the WRNM reading isgreater than a specified minimum count rate, which ensuresthat the detectors are indicating count rates indicative ofneutron flux levels within the core. The signal-to-noiseratio shown in Figure 3.3.1.2-1 is the WRNM count rate atwhich there is a 95% probability that the WRNM signalindicates the presence of neutrons and only a 5% probability

(continued)



BASES


that the WRNM signal is the result of noise (Ref. 1). Withfew fuel assemblies loaded, the WRNMs will not have a highenough count rate to satisfy the SR. Therefore, allowancesare made for loading sufficient "source" material, in theform of irradiated fuel assemblies, to establish the minimumcount rate.

To accomplish this, the SR is modified by Note 1 that statesthat the count rate is not required to be met on a WRNM thathas less than or equal to four fuel assemblies adjacent tothe WRNM and no other fuel assemblies are in the associatedcore quadrant. With four or less fuel assemblies loadedaround each WRNM and no other fuel assemblies in theassociated core quadrant, even with a control rod withdrawn,the configuration will not be critical. In addition, Note 2states that this requirement does not have to be met duringspiral unloading. If the core is being unloaded in thismanner, the various core configurations encountered will notbe critical.

The Frequency is based upon channel redundancy and otherinformation available in the control room, and ensures thatthe required channels are frequently monitored while corereactivity changes are occurring. When no reactivitychanges are in progress, the Frequency is relaxed from12 hours to 24 hours.

SR 3.3.1.2.5

Performance of a CHANNEL FUNCTIONAL TEST demonstrates theassociated channel will function properly. SR 3.3.1.2.5 isrequired in MODES 2, 3, 4 and 5 and the 31 day Frequencyensures that the channels are OPERABLE while core reactivitychanges could be in progress. This Frequency is reasonable,based on operating experience, fixed incore detectors,overall reliability, self-monitoring features, and on otherSurveillances (such as a CHANNEL CHECK), that ensure properfunctioning between CHANNEL FUNCTIONAL TESTS.

(continued)



BASES


Verification of the signal to noise ratio also ensures thatthe detectors are correctly monitoring the neutron flux.

The Note to the Surveillance allows the Surveillance to bedelayed until entry into the specified condition of theApplicability (THERMAL POWER decreased to WRNM reading of125E-5 % power or below). The SR must be performed within12 hours after WRNMs are reading 125E-5 % power or below.The allowance to enter the Applicability with the 31 dayFrequency not met is reasonable, based-on the limited timeof 12 hours allowed after entering the Applicability.Although the Surveillance could be performed while at higherpower, the plant would not be expected to maintain steadystate operation at this power level. In this event, the12 hour Frequency is reasonable, based on the WRNMs beingotherwise verified to be OPERABLE (i.e., satisfactorilyperforming the CHANNEL CHECK) and the time required toperform the Surveillances.

SR 3.3.1.2.6

Performance of a CHANNEL CALIBRATION at a Frequency of 24months verifies the performance of the WRNM detectors andassociated circuitry. The Frequency considers the plantconditions required to perform the test, the ease of

(continued)



BASES


performing the test, and the likelihood of a change in thesystem or component status. Note 1 excludes the neutrondetectors from the CHANNEL CALIBRATION because they cannotreadily be adjusted. The detectors are fission chambersthat are designed to have a relatively constant sensitivityover the range and with an accuracy specified for a fixeduseful life.

Note 2 to the Surveillance allows the Surveillance to bedelayed until entry into the specified condition of theApplicability. The SR must be performed in MODE 2 within12 hours of entering MODE 2 with WRNMs reading 125E-5 %power or below. The allowance to enter the Applicabilitywith the 24 month Frequency not met is reasonable, based onthe limited time of 12 hours allowed after entering theApplicability. Although the Surveillance could be performedwhile at higher power, the plant would not be expected tomaintain steady state operation at this power level. Inthis event, the 12 hour Frequency is reasonable, based onthe WRNMs being otherwise verified to be OPERABLE (i.e.,satisfactorily performing the CHANNEL CHECK) and the timerequired to perform the Surveillance.

REFERENCES 1. NRC Safety Evaluation Report for Amendment Numbers 147and 149 to Facility Operating License Numbers DPR-44and DPR-56, Peach Bottom Atomic Power Station, UnitNos. 2 and 3, August 28, 1989.


Control Rod Block InstrumentationB 3.3.2.1


B 3.3.2.1 Control Rod Block Instrumentation

BASES

BACKGROUND Control rods provide the primary means for control ofreactivity changes. Control rod block instrumentationincludes channel sensors, logic circuitry, switches, andrelays that are designed to ensure that specified fueldesign limits are not exceeded for postulated transients andaccidents. During high power operation, the rod blockmonitor (RBM) provides protection for control rod withdrawalerror events. During low power operations, control rodblocks from the rod worth minimizer (RWM) enforce specificcontrol rod sequences designed to mitigate the consequencesof the control rod drop accident (CRDA). During shutdownconditions, control rod blocks from the Reactor ModeSwitch-Shutdown Position Function ensure that all controlrods remain inserted to prevent inadvertent criticalities.

The purpose of the RBM is to limit control rod withdrawal iflocalized neutron flux exceeds a predetermined setpointduring control rod manipulations. It is assumed to functionto block further control rod withdrawal to preclude a MCPRSafety Limit (SL) violation. The RBM supplies a trip signal W

to the Reactor Manual Control System (RMCS) to appropriatelyinhibit control rod withdrawal during power operation abovethe low power range setpoint. The RBM has two channels,either of which can initiate a control rod block when thechannel output exceeds the control rod block setpoint. OneRBM channel inputs into one RMCS rod block circuit and theother RBM channel inputs into the second RMCS rod blockcircuit. The RBM channel signal is generated by averaging aset of local power range monitor (LPRM) signals at variouscore heights surrounding the control rod being withdrawn. Asignal from one of the four redundant average power rangemonitor (APRM) channels supplies a reference signal for oneof the RBM channels and a signal from another of the APRMchannels supplies the reference signal to the second RBMchannel. This reference signal is used to determine whichRBM range setpoint (low, intermediate, or high) is enabled.If the APRM is indicating less than the low power rangesetpoint, the RBM is automatically bypassed. The RBM isalso automatically bypassed if a peripheral control rod isselected (Ref. 1). A rod block signal is also generated ifan RBM inoperable trip occurs, since this could indicate aproblem with the RBM channel.

(continued)



BASES

BACKGROUND The inoperable trip will occur if, during the nulling(continued) (normalization) sequence, the RBM channel fails to null or

too few LPRM inputs are available, if a critical self-testfault has been detected, or the RBM instrument mode switchis moved to any position other than "Operate".

The purpose of the RWM is to control rod patterns duringstartup and shutdown, such that only specified control rodsequences and relative positions are allowed over theoperating range from all control rods inserted to 10% RTP.The sequences effectively limit the potential amount andrate of reactivity increase during a CRDA. Prescribedcontrol rod sequences are stored in the RWM, which willinitiate control rod withdrawal and insert blocks when theactual sequence deviates beyond allowances from the storedsequence. The RWM determines the actual sequence basedposition indication for each control rod. The RWM also usesfeedwater flow and steam flow signals to determine when thereactor power is above the preset power level at which theRWM is automatically bypassed (Ref. 2). The RWM is a singlechannel system that provides input into both RMCS rod blockcircuits.

With the reactor mode switch in the shutdown position, acontrol rod withdrawal block is applied to all control rodsto ensure that the shutdown condition is maintained. ThisFunction prevents inadvertent criticality as the result of acontrol rod withdrawal during MODE 3 or 4, or during MODE 5when the reactor mode switch is required to be in theshutdown position. The reactor mode switch has twochannels, each inputting into a separate RMCS rod blockcircuit. A rod block in either RMCS circuit will provide acontrol rod block to all control rods.

APPLICABLE 1. Rod Block MonitorSAFETY ANALYSES,LCO, and The RBM is designed to prevent violation of the MCPRAPPLICABILITY SL and the cladding 1% plastic strain fuel design limit that

may result from a single control rod withdrawal error (RWE)event. The analytical methods and assumptions used inevaluating the RWE event are summarized in Reference 1. A

(continued)



BASES

APPLICABLE 1. Rod Block Monitor (continued)SAFETY ANALYSES,LCO, and statistical analysis of RWE events was performed toAPPLICABILITY determine the RBM response for both channels for each event.

From these responses, the fuel thermal performance as afunction of RBM Allowable Value was determined. TheAllowable Values are chosen as a function of power level.The Allowable Values are specified in the CORE OPERATINGLIMITS REPORT (COLR). Based on the specified AllowableValues, operating limits are established.

The RBM Function satisfies Criterion 3 of the NRC Policy

Statement.

Two channels of the RBM are required to be OPERABLE, withtheir setpoints within the appropriate Allowable Values toensure that no single instrument failure can preclude a rodblock from this Function. The actual setpoints arecalibrated consistent with applicable setpoint methodology.

Trip setpoints are specified in the setpoint calculations.The trip setpoints are selected to ensure that the setpointsdo not exceed the Allowable Values between successiveCHANNEL CALIBRATIONS. Operation with a trip setting lessconservative than the trip setpoint, but within itsAllowable Value, is acceptable. Trip setpoints are thosepredetermined values of output at which an action shouldtake place. The setpoints are compared to the actualprocess parameter (e.g., reactor power), and when themeasured output value of the process parameter exceeds thesetpoint, the associated device (e.g., trip unit) changesstate. The analytic or design limits are derived from thelimiting values of the process parameters obtained from thesafety analysis or other appropriate documents. TheAllowable Values are derived from the analytic or designlimits, corrected for calibration, process, and instrumenterrors. The trip setpoints are determined from analyticalor design limits, corrected for calibration, process, andinstrument errors, as well as, instrument drift. Inselected cases, the Allowable Values and trip setpoints aredetermined by engineering judgement or historically acceptedpractice relative to the intended function of the channel.The trip setpoints determined in this manner provideadequate protection by assuring instrument and processuncertainties expected for the environments during theoperating time of the channels are accounted for.

(continued)



BASES


1. Rod Block Monitor (continued)

The RBM is assumed to mitigate the consequences of an RWEevent when operating : 30% RIP. Below this power level, theconsequences of an RWE event will not exceed the MCPR SLand, therefore, the RBM is not required to be OPERABLE(Ref. I). When operating < 90% RTP, analyses (Ref. 1) haveshown that with an initial MCPR ; 1.70, no RWE event willresult in exceeding the MCPR SL. Also, the analysesdemonstrate that when operating at • 90% RTP withMCPR 2 1.40, no RWE event will result in exceeding the MCPRSL (Ref. 1). Therefore, under these conditions, the RBM isalso not required to be OPERABLE.

2. Rod Worth Minimizer

The RWM enforces the banked position withdrawal sequence(BPWS) to ensure that the initial conditions of the CRDAanalysis are not violated. The analytical methods andassumptions used in evaluating the CRDA are summarized inReferences 3, 4, 5, and 6. The BPWS requires that controlrods be moved in groups, with all control rods assigned to aspecific group required to be within specified bankedpositions. Requirements that the control rod sequence is incompliance with the BPWS are specified in LCO 3.1.6, "RodPattern Control."

The RWM Function satisfies Criterion 3 of the NRC PolicyStatement.

Since the RWM is a hardwired system designed to act as abackup to operator control of the rod sequences, only onechannel of the RWM is available and required to be OPERABLE(Ref. 6). Special circumstances provided for in theRequired Action of LCO 3.1.3, "Control Rod OPERABILITY," andLCO 3.1.6 may necessitate bypassing the RWM to allowcontinued operation with inoperable control rods, or toallow correction of a control rod pattern not in compliancewith the BPWS. The RWM may be bypassed as required by theseconditions, but then it must be considered inoperable andthe Required Actions of this LCO followed.

(continued)



BASES


2. Rod Worth Minimizer (continued)

Compliance with the BPWS, and therefore OPERABILITY of theRWM, is required in MODES 1 and 2 when THERMAL POWER is< 10% RTP. When THERMAL POWER is > 10% RTP, there is nopossible control rod configuration that results in a controlrod worth that could exceed the 280 cal/gm fuel damage limitduring a CRDA (Refs. 4 and 6). In MODES 3 and 4, allcontrol rods are required to be inserted into the core;therefore, a CRDA cannot occur. In MODE 5, since only asingle control rod can be withdrawn from a core cellcontaining fuel assemblies, adequate SDM ensures that theconsequences of a CRDA are acceptable, since the reactorwill be subcritical.

3. Reactor Mode Switch-Shutdown Position

During MODES 3 and 4, and during MODE 5 when the reactormode switch is required to be in the shutdown position, thecore is assumed to be subcritical; therefore, no positivereactivity insertion events are analyzed. The Reactor ModeSwitch-Shutdown Position control rod withdrawal blockensures that the reactor remains subcritical by blockingcontrol rod withdrawal, thereby preserving the assumptionsof the safety analysis.

The Reactor Mode Switch-Shutdown Position Functionsatisfies Criterion 3 of the NRC Policy Statement.

Two channels are required to be OPERABLE to ensure that nosingle channel failure will preclude a rod block whenrequired. There is no Allowable Value for this Functionsince the channels are mechanically actuated based solely onreactor mode switch position.

During shutdown conditions (MODE 3, 4, or 5), no positivereactivity insertion events are analyzed because assumptionsare that control rod withdrawal blocks are provided toprevent criticality. Therefore, when the reactor modeswitch is in the shutdown position, the control rodwithdrawal block is required to be OPERABLE. During MODE 5with the reactor mode switch in the refueling position, therefuel position one-rod-out interlock (LCO 3.9.2, "RefuelPosition One-Rod-Out Interlock") provides the requiredcontrol rod withdrawal blocks.

(continued)



BASES (continued)

ACTIONS A.1

With one RBM channel inoperable, the remaining OPERABLEchannel is adequate to perform the control rod blockfunction; however, overall reliability is reduced because asingle failure in the remaining OPERABLE channel can resultin no control rod block capability for the RBM. For thisreason, Required Action A.1 requires restoration of theinoperable channel to OPERABLE status. The Completion Timeof 24 hours is based on the low probability of an eventoccurring coincident with a failure in the remainingOPERABLE channel.

B.1

If Required Action A.1 is not met and the associatedCompletion Time has expired, the inoperable channel must beplaced in trip within 1 hour. If both RBM channels areinoperable, the RBM is not capable of performing itsintended function; thus, one channel must also be placed intrip. This initiates a control rod withdrawal block,thereby ensuring that the RBM function is met.

The I hour Completion Time is intended to allow the operatortime to evaluate and repair any discovered inoperabilitiesand is acceptable because it minimizes risk while allowingtime for restoration or tripping of inoperable channels.

C.1, C.2.1.1. C.2.1.2. and C.2.2

With the RWM inoperable during a reactor startup, theoperator is still capable of enforcing the prescribedcontrol rod sequence. However, the overall reliability isreduced because a single operator error can result inviolating the control rod sequence. Therefore, control rodmovement must be immediately suspended except by scram.Alternatively, startup may continue if at least 12 controlrods have already been withdrawn, or a reactor startup withan inoperable RWM was not performed in the last 12 months.These requirements minimize the number of reactor startupsinitiated with the RWM inoperable. Required Actions C.2.1.1and C.2.1.2 require verification of these conditions byreview of plant logs and control room indications. OnceRequired Action C.2.1.1 or C.2.1.2 is satisfactorily

(continued)



BASES

ACTIONS C.1, C.2.1.1, C.2.1.2, and C.2.2 (continued)

completed, control rod withdrawal may proceed in accordancewith the restrictions imposed by Required Action C.2.2.Required Action C.2.2 allows for the RWM Function to beperformed manually and requires a double check of compliancewith the prescribed rod sequence by a second licensedoperator (Reactor Operator or Senior Reactor Operator) orother qualified member of the technical staff. The RWM maybe bypassed under these conditions to allow continuedoperations. In addition, Required Actions of LCO 3.1.3 andLCO 3.1.6 may require bypassing the RWM, during which timethe RWM must be considered inoperable with Condition Centered and its Required Actions taken.

D.]

With the RWM inoperable during a reactor shutdown, theoperator is still capable of enforcing the prescribedcontrol rod sequence. Required Action D.1 allows for theRWM Function to be performed manually and requires a doublecheck of compliance with the prescribed rod sequence by asecond licensed operator (Reactor Operator or Senior ReactormOperator) or other qualified member of the technical staff. WThe RWM may be bypassed under these conditions to allow thereactor shutdown to continue.

E.1 and E.2

With one Reactor Mode Switch-Shutdown Position control rodwithdrawal block channel inoperable, the remaining OPERABLEchannel is adequate to perform the control rod withdrawalblock function. However, since the Required Actions areconsistent with the normal action of an OPERABLE ReactorMode Switch-Shutdown Position Function (i.e., maintainingall control rods inserted), there is no distinction betweenhaving one or two channels inoperable.

In both cases (one or both channels inoperable), suspendingall control rod withdrawal and initiating action to fullyinsert all insertable control rods in core cells containingone or more fuel assemblies will ensure that the core issubcritical with adequate SDM ensured by LCO 3.1.1. Controlrods in core cells containing no fuel assemblies do not

(continued)



BASES

ACTIONS E.1 and E.2 (continued)

affect the reactivity of the core and are therefore notrequired to be inserted. Action must continue until allinsertable control rods in core cells containing one or morefuel assemblies are fully inserted.


As noted at the beginning of the SRs, the SRs for eachControl Rod Block instrumentation Function are found in theSRs column of Table 3.3.2.1-1.

The Surveillances are modified by a Note to indicate thatwhen an RBM channel is placed in an inoperable status solelyfor performance of required Surveillances, entry intoassociated Conditions and Required Actions may be delayedfor up to 6 hours provided the associated Function maintainscontrol rod block capability. Upon completion of theSurveillance, or expiration of the 6 hour allowance, thechannel must be returned to OPERABLE status or theapplicable Condition entered and Required Actions taken.This Note is based on the reliability analysis (Refs. 8, 9,& 10) assumptions of the average time required to performchannel surveillances. That analysis demonstrated that the6 hour testing allowance does not significantly reduce theprobability that a control rod block will be initiated whennecessary.

SR 3.3.2.1.1

A CHANNEL FUNCTIONAL TEST is performed for each RBM channelto ensure that the entire channel will perform the intendedfunction. Any setpoint adjustment shall be consistent withthe assumptions of the current plant specific setpointmethodology. The Frequency of 184 days is based onreliability analyses (Refs. 7, 9 & 10).

(continued)



BASES


(continued)

SR 3.3.2.1.2 and SR 3.3.2.1.3

A CHANNEL FUNCTIONAL TEST is performed for the RWM to ensurethat the entire system will perform the intended function.The CHANNEL FUNCTIONAL TEST for the RWM is performed byattempting to withdraw a control rod not in compliance withthe prescribed sequence and verifying a control rodblockoccurs. SR 3.3.2.1.2 is performed during a startup andSR 3.3.2.1.3 is performed during a shutdown (or powerreduction to • 10% RTP). As noted in the SRs, SR 3.3.2.1.2is not required to be performed until 1 hour after anycontrol rod is withdrawn at - 10% RTP in MODE 2. As noted,SR 3.3.2.1.3 is not required to be performed until 1 hourafter THERMAL POWER is • 10% RTP in MODE 1. This allowsentry at • 10% RTP in MODE 2 for SR 3.3.2.1.2 and entry intoMODE 1 when THERMAL POWER is : 10% RTP for SR 3.3.2.1.3 toperform the required Surveillance if the 92 day Frequency isnot met per SR 3.0.2. The I hour allowance is based onoperating experience and in consideration of providing areasonable time in which to complete the SRs. TheFrequencies are based on reliability analysis (Ref. 7).

SR 3.3.2.1.4

The RBM setpoints are automatically varied as a function ofpower. Three Allowable Values are specified in the COLR,each within a specific power range. The power at which thecontrol rod block Allowable Values automatically change arebased on the APRM signal's input to each RBM channel. Belowthe minimum power setpoint, the RBM is automaticallybypassed. These power Allowable Values must be verifiedusing a simulated or actual signal periodically to be lessthan or equal to the specified values. If any power rangesetpoint is nonconservative, then the affected RBM channelis considered inoperable. Alternatively, the power range

(continued)



BASES


channel can be placed in the conservative condition (i.e.,enabling the proper RBM setpoint). If placed in thiscondition, the SR is met and the RBM channel is notconsidered inoperable. As noted, neutron detectors areexcluded from the Surveillance because they are passivedevices, with minimal drift, and because of the difficultyof simulating a meaningful signal.

Neutron detectors are adequately tested in SR 3.3.1.1.2 andSR 3.3.1.1.8. The 24 month Frequency is based on the actualtrip setpoint methodology utilized for these channels.

SR 3.3.2.1.5

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations consistent with the plant specific setpointmethodology.

As noted, neutron detectors are excluded from the CHANNELCALIBRATION because they are passive devices, with minimaldrift, and because of the difficulty of simulating ameaningful signal. Neutron detectors are adequately testedin SR 3.3.1.1.2 and SR 3.3.1.1.8. The Frequency is basedupon the assumption of a 24 month calibration interval inthe determination of the magnitude of equipment drift in thesetpoint analysis.

(continuedl



BASES


(continued)

SR 3.3.2.1.6

The RWM is automatically bypassed when power is above aspecified value. The power level is determined fromfeedwater flow and steam flow signals. The automatic bypasssetpoint must be verified periodically to be > 10% RTP. Ifthe RWM low power setpoint is nonconservative, then the RWMis considered inoperable. Alternately, the low powersetpoint channel can be placed in the conservative condition(nonbypass). If placed in the nonbypassed condition, the SRis met and the RWM is not considered inoperable. TheFrequency is based on the trip setpoint methodology utilizedfor the low power setpoint channel.

SR 3.3.2.1.7 0A CHANNEL FUNCTIONAL TEST is performed for the Reactor ModeSwitch-Shutdown Position Function to ensure that the entirechannel will perform the intended function. The CHANNELFUNCTIONAL TEST for the Reactor Mode Switch-ShutdownPosition Function is performed by attempting to withdraw anycontrol rod with the reactor mode switch in the shutdownposition and verifying a control rod block occurs.

As noted in the SR, the Surveillance is not required to beperformed until 1 hour after the reactor mode switch is inthe shutdown position, since testing of this interlock withthe reactor mode switch in any other position cannot beperformed without using jumpers, lifted leads, or movablelinks. This allows entry into MODES 3 and 4 if the 24 monthFrequency is not met per SR 3.0.2. The 1 hour allowance isbased on operating experience and in consideration ofproviding a reasonable time in which to complete the SR.

(continued)



BASES


The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown these components will passthe Surveillance when performed at the 24 month Frequency.

SR 3.3.2.1.8

The RWM will only enforce the proper control rod sequence ifthe rod sequence is properly input into the RWM computer.This SR ensures that the proper sequence is loaded into theRWM so that it can perform its intended function. TheSurveillance is performed once prior to declaring RWMOPERABLE following loading of sequence into RWM, since thisis when rod sequence input errors are possible.

REFERENCES 1. NEDC-32162-P, "Maximum Extended Load Line Limit andARTS Improvement Program Analysis for Peach BottomAtomic Power Station, Units 2 and 3," Revision 1,

February 1993.

2. UFSAR, Sections 7.10.3.4.8 and 7.16.3.

3. NEDE-24011-P-A-10-US, "General Electric StandardApplication for Reload Fuel," Supplement for UnitedStates, Section S 2.2.3.1, February 1991.

4. "Modifications to the Requirements for Control RodDrop Accident Mitigating Systems," BWR Owners' Group,July 1986.

5. NEDO-21231, "Banked Position Withdrawal Sequence,"January 1977.

6. NRC SER, "Acceptance of Referencing of LicensingTopical Report NEDE-24011-P-A," "General ElectricStandard Application for Reactor Fuel, Revision 8,Amendment 17," December 27, 1987.

(continued)


Control Rod Block InstrumentationB 3.3.2.1 0

BASES

REFERENCES 7. NEDC-30851-P-A, "Technical Specification Improvement(continued) Analysis for BWR Control Rod Block Instrumentation,"

October 1988.

8. GENE-770-06-I, "Addendum to Bases for Changes toSurveillance Test Intervals and Allowed Out-of-ServiceTimes for Selected Instrumentation TechnicalSpecifications," February 1991.

9. NEDC-32410P-A, "Nuclear Measurement Analysis andControl Power Range Neutron Monitor (NUMAC PRNM)Retrofit Plus Option III Stability Trip Function",March 1995.

10. NEDC-32410P Supplement 1, "Nuclear MeasurementAnalysis and Control Power Range Neutron Monitor(NUMAC PRNM) Retrofit Plus Option III Stability TripFunction, Supplement I", November 1997.


Feedwater and Main Turbine High Water Level Trip InstrumentationB 3.3.2.2


B 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation

BASES

BACKGROUND The feedwater and main turbine high water level tripinstrumentation is designed to detect a potential failure ofthe Feedwater Level Control System that causes excessivefeedwater flow.

With excessive feedwater flow, the water level in thereactor vessel rises toward the high water level setpoint,causing the trip of the three feedwater pump turbines andthe main turbine.

Digital Feedwater Control System (DFCS) high water levelsignals are provided by six level sensors. However, onlythree narrow range level sensors are required to perform thefunction with sufficient redundancy. The three levelsensors sense the difference between the pressure due to aconstant column of water (reference leg) and the pressuredue to the actual water level in the reactor vessel(variable leg). The three level signals are input into tworedundant digital control computers. Any one of the threesignals is automatically selected (by the digital controlcomputer) as the signal to be used for the high level trip.

Each digital control computer has two redundant digitaloutputs (channels) to provide redundant signals to anassociated trip system. Each digital control computerprocesses input signals and compares them to pre-establishedsetpoints. When the setpoint is exceeded, the two digitaloutputs actuate two contacts arranged in parallel so thateither digital output can trip the associated trip system.The tripping of both digital computer trip systems willinitiate a trip of the feedwater pump turbines and the mainturbine.

A trip of the feedwater pump turbines limits furtherincrease in reactor vessel water level by limiting furtheraddition of feedwater to the reactor vessel. A trip of themain turbine and closure of the stop valves protects theturbine from damage due to water entering the turbine.

(continued)



BASES (continued)

APPLICABLE The feedwater and main turbine high water level tripSAFETY ANALYSES instrumentation is assumed to be capable of providing a

turbine trip in the design basis transient analysis for afeedwater controller failure, maximum demand event (Ref. 1).The high water level trip indirectly initiates a reactorscram from the main turbine trip (above 29.5% RTP) andtrips the feedwater pumps, thereby terminating the event.The reactor scram mitigates the reduction in MCPR.

Feedwater and main turbine high water level tripinstrumentation satisfies Criterion 3 of the NRC PolicyStatement.

LCO The LCO requires two DFCS channels per trip system of highwater level trip instrumentation to be OPERABLE to ensurethe feedwater pump turbines and main turbine will trip on avalid reactor vessel high water level signal. Two DFCSchannels (one per trip system) are needed to provide tripsignals in order for the feedwater and main turbine trips tooccur.

Two level signals are also required to ensure a singlesensor failure will not prevent the trips of the feedwaterpump turbines and main turbine when reactor vessel water 4level is at the high water level reference point.

Each channel must have its setpoint set within the specifiedAllowable Value of SR 3.3.2.2.3. The Allowable Value is setto ensure that the thermal limits are not exceeded duringthe event. The actual setpoint is calibrated to beconsistent with the applicable setpoint methodologyassumptions. Trip setpoints are specified in the setpointcalculations. The trip setpoints are selected to ensurethat the setpoints do not exceed the Allowable Value betweensuccessive CHANNEL CALIBRATIONS. Operation with a tripsetting less conservative than the trip setpoint, but withinits Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output atwhich an action.should take place. The setpoints arecompared to the actual process parameter (e.g., reactorvessel water level), and when the measured output value ofthe process parameter exceeds the setpoint, the associateddevice (e.g., trip unit) changes state. The analytic ordesign limits are derived from the limiting values of theprocess parameters obtained from the safety analysis or

(continued)



BASES

LCO(continued)

other appropriate documents. The Allowable Values arederived from the analytic or design limits, corrected forcalibration, process, and instrument errors. A channel isinoperable if its actual trip setting is not within itsrequired Allowable Value. The trip setpoints are determinedfrom analytical or design limits, corrected for calibration,process and instrument errors, as well as, instrument drift.The trip setpoints determined in this manner provideadequate protection by assuring instrument and processuncertainties expected for the environment during theoperating time for the associated channels are accountedfor.

APPLICABILITY The feedwater and main turbine high water level tripinstrumentation is required to be OPERABLE at Ž 25% RTP toensure that the fuel cladding integrity Safety Limit and thecladding 1% plastic strain limit are not violated during thefeedwater controller failure, maximum demand event. Asdiscussed in the Bases for LCO 3.2.3, ",LINEAR HEATGENERATION RATE (LHGR)," and LCO 3.2.2, "MINIMUM CRITICALPOWER RATIO (MCPR)," sufficient margin to these limitsexists below 25% RTP; therefore, these requirements are onlynecessary when operating at or above this power level.

ACTIONS A Note has been provided to modify the ACTIONS related tofeedwater and main turbine high water level tripinstrumentation channels. Section 1.3, Completion Times,specifies that once a Condition has been entered, subsequentdivisions, subsystems, components, or variables expressed inthe Condition, discovered to be inoperable or not withinlimits, will not result in separate entry into theCondition. Section 1.3 also specifies that Required Actionsof the Condition continue to apply for each additionalfailure, with Completion Times based on initial entry intothe Condition. However, the Required Actions for inoperablefeedwater and main turbine high water level tripinstrumentation channels provide appropriate compensatorymeasures for separate inoperable channels. As such, a Notehas been provided that allows separate Condition entry foreach inoperable feedwater and main turbine high water leveltrip instrumentation channel.

(continued)



BASES


With one or more feedwater and main turbine high water leveltrip channels inoperable, but with feedwater and mainturbine high water level trip capability maintained (referto Required Action B.1 Bases), the remaining OPERABLEchannels can provide the required trip signal. However,overall instrumentation reliability is reduced because asingle active instrument failure in one of the remainingchannels may result in the instrumentation not being able toperform its intended function. Therefore, continuedoperation is only allowed for a limited time with one ormore channels inoperable. If the inoperable channels cannotbe restored to OPERABLE status within the Completion Time,the channels must be placed in the tripped condition perRequired Action A.1. Placing the inoperable channel in tripwould conservatively compensate for the inoperability,restore capability to accommodate a single active instrumentfailure, and allow operation to continue with no furtherrestrictions. Alternately, if it is not desired to placethe channel in trip (e.g., as in the case where placing theinoperable channel in trip would result in the feedwater andmain turbine trip), Condition C must be entered and itsRequired Action taken.

The Completion Time of 72 hours is based on the lowprobability of the event occurring coincident with a singlefailure in a remaining OPERABLE channel.

B._1

Required Action B.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels result in the High Water Level Function of DFCS notmaintaining feedwater and main turbine trip capability. Inthis condition, the feedwater and main turbine high waterlevel trip instrumentation cannot perform its designfunction. Therefore, continued operation is only permittedfor a 2 hour period, during which feedwater and main turbinehigh water level trip capability must be restored. The tripcapability is considered maintained when sufficient channelsare OPERABLE or in trip such that the feedwater and mainturbine high water level trip logic will generate a trip

(continued)

PBAPS UNIT.2 B 3.3-61 Revision No. 0


BASES


signal on a valid signal. This requires one channel pertrip system to be OPERABLE or in trip. If the requiredchannels cannot be restored to OPERABLE status or placed intrip, Condition C must be entered and its Required Actiontaken.

The 2 hour Completion Time is sufficient for the operator totake corrective action, and takes into account thelikelihood of an event requiring actuation of feedwater andmain turbine high water level trip instrumentation occurringduring this period. It is also consistent with the 2 hourCompletion Time provided in LCO 3.2.2 for RequiredAction A.1, since this instrumentation's purpose is topreclude a MCPR violation.

C.1 and C.2

With any Required Action and associated Completion Time notmet, the plant must be brought to a MODE or other specifiedcondition in which the LCO does not apply. To achieve thisstatus, THERMAL POWER must be reduced to < 25% RTP within4 hours. Alternatively, the affected feedwater pump(s) andaffected main turbine valve(s) may be removed from servicesince this performs the intended function of theinstrumentation. As discussed in the Applicability sectionof the Bases, operation below 25% RTP results in sufficientmargin to the required limits, and the feedwater and mainturbine high water level trip instrumentation is notrequired to protect fuel integrity during the feedwatercontroller failure, maximum demand event. The allowedCompletion Time of 4 hours is based on operating experienceto reduce THERMAL POWER to < 25% RTP from full powerconditions in an orderly manner and without challengingplant systems.

Required Action C.1 is modified by a Note which states thatthe Required Action is only applicable if the inoperablechannel is the result of an inoperable feedwater pumpturbine or main turbine stop valve. The Note clarifies thesituations under which the associated Required Action wouldbe the appropriate Required Action.

SURVEILLANCE The Surveillances are modified by a Note to indicate thatREQUIREMENTS when a channel is placed in an inoperable status solely for

performance of required Surveillances, entry into associatedConditions and Required Actions may be delayed for up to6 hours provided the associated Function maintains feedwaterand main turbine high water level trip capability. Uponcompletion of the Surveillance, or expiration of the 6 hourallowance, the channel must be returned to OPERABLE statusor the applicable Condition entered and Required Actionstaken. This Note is based on the reliability analysis(Ref. 2) assumption of the average time required to perform

(continued)



BASES

SURVEILLANCE channel Surveillance. That analysis demonstrated that theREQUIREMENTS 6 hour testing allowance does not significantly reduce the

(continued) probability that the feedwater pump turbines and mainturbine will trip when necessary.

SR 3.3.2.2.1

Performance of the CHANNEL CHECK once every 24 hours ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. The CHANNEL CHECK may be performed by comparingindication or by verifying the absence of the DFCS "TROUBLE"alarm in the control room. It is based on the assumptionthat instrument channels monitoring the same parametershould read approximately the same value. Significantdeviations between instrument channels could be anindication of excessive instrument drift in one of thechannels, or something even more serious. A CHANNEL CHECKwill detect gross channel failure; thus, it is key toverifying the instrumentation continues to operate properlybetween each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff basedon a combination of the channel instrument uncertainties,including indication and readability. If a channel isoutside the criteria, it may be an indication that theinstrument has drifted outside its limits.

The Frequency is based on operating experience thatdemonstrates channel failure is rare. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannel status during normal operational use of the displaysassociated with the channels required by the LCO.

SR 3.3.2.2.2

A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function. Any setpoint adjustment shall beconsistent with the assumptions of the current plantspecific setpoint methodology. The Frequency of 92 days isbased on reliability analysis (Ref. 2).

(continued)



BASES


(continued)

SR 3.3.2.2.3

CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the assumptions of the currentplant specific setpoint methodology.

The Frequency is based upon the assumption of a 24 monthcalibration interval in the determination of the magnitudeof equipment drift in the setpoint analysis.

SR 3.3.2.2.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required trip logic for a specificchannel. The system functional test of the feedwater andmain turbine stop valves is included as part of thisSurveillance and overlaps the LOGIC SYSTEM FUNCTIONAL TESTto provide complete testing of the assumed safety function.Therefore, if a stop valve is incapable of operating, theassociated instrumentation channels would be inoperable.The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown that these components willpass the Surveillance when performed at the 24 monthFrequency.


2. GENE-770-06-1, "Bases for Changes to Surveillance TestIntervals and Allowed Out-Of-Service Times forSelected Instrumentation Technical Specifications,"February 1991.


PAM InstrumentationB 3.3.3.1


B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation

BASES

BACKGROUND The primary purpose of the PAM instrumentation is to displayplant variables that provide information required by thecontrol room operators during accident situations. Thisinformation provides the necessary support for the operatorto take the manual actions for which no automatic control isprovided and that are required for safety systems toaccomplish their safety functions for Design Basis Events.The instruments that monitor these variables are designatedas Type A, Category I, and non-Type A, Category I, inaccordance with Regulatory Guide 1.97 (Ref. 1).

The OPERABILITY of the accident monitoring instrumentationensures that there is sufficient information available onselected plant parameters to monitor and assess plant statusand behavior following an accident. This capability isconsistent with the recommendations of Reference 1.


The PAM instrumentation LCO ensures the OPERABILITY ofRegulatory Guide 1.97, Type A variables so that the controlroom operating staff can:

Perform the diagnosis specified in the EmergencyOperating Procedures (EOPs). These variables arerestricted to preplanned actions for the primarysuccess path of Design Basis Accidents (DBAs), (e.g.,loss of coolant accident (LOCA)), and

Take the specified, preplanned, manually controlledactions for which no automatic control is provided,which are required for safety systems to accomplishtheir safety function.

The PAM instrumentation LCO also ensures OPERABILITY ofCategory I, non-Type A, variables so that the control roomoperating staff can:

* Determine whether systems important to safety areperforming their intended functions;

(continued)



BASES

APPLICABLE 0 Determine the potential for causing a gross breach ofSAFETY ANALYSES the barriers to radioactivity release;

(continued)" Determine whether a gross breach of a barrier has

occurred; and

* Initiate action necessary to protect the public andfor an estimate of the magnitude of any impendingthreat.

The plant specific Regulatory Guide 1.97 Analysis (Refs. 2,3, and 4) documents the process that identified Type A andCategory I, non-Type A, variables.

Accident monitoring instrumentation that satisfies thedefinition of Type A in Regulatory Guide 1.97 meetsCriterion 3 of the NRC Policy Statement. Category I,non-Type A, instrumentation is retained in TechnicalSpecifications (TS) because they are intended to assistoperators in minimizing the consequences of accidents.Therefore, these Category I variables are important forreducing public risk.

LCO LCO 3.3.3.1 requires two OPERABLE channels for all but oneFunction to ensure that no single failure prevents theoperators from being presented with the informationnecessary to determine the status of the plant and to bringthe plant to, and maintain it in, a safe condition followingthat accident. Furthermore, provision of two channelsallows a CHANNEL CHECK during the post accident phase toconfirm the validity of displayed information.

The exception to the two channel requirement is primarycontainment isolation valve (PCIV) position. In this case,the important information is the status of the primarycontainment penetrations. The LCO requires one positionindicator for each active PCIV. This is sufficient toredundantly verify the isolation status of each isolablepenetration either via indicated status of the active valveand prior knowledge of passive valve or via system boundarystatus. If a normally active PCIV is known to be closed anddeactivated, position indication is not needed to determinestatus. Therefore, the position indication for valves inthis state is not required to be OPERABLE.

(continued)



BASES

LCO The following list is a discussion of the specified(continued) instrument Functions listed in Table 3.3.3.1-1 in the

accompanying LCO.

1. Reactor Pressure

Instruments: PR-2-2-3-404 A, B

Reactor pressure is a Category I variable provided tosupport monitoring of Reactor Coolant System (RCS) integrityand to verify operation of the Emergency Core CoolingSystems (ECCS). Two independent pressure transmitters witha range of 0 psig to 1500 psig monitor pressure andassociated independent wide range recorders are the primaryindication used by the operator during an accident.Therefore, the PAM Specification deals specifically withthis portion of the instrument channel.

2. 3. Reactor Vessel Water Level (Wide Range and Fuel Zone)

Instruments: Wide Range: LR-2-2-3-110 A, B (Green Pen)Fuel Zone: LR-2-2-3-11O A, B (Blue Pen)

Reactor vessel water level is a Category I variable providedto support monitoring of core cooling and to verifyoperation of the ECCS. The wide range and fuel zone waterlevel channels provide the PAM Reactor Vessel Water LevelFunctions. The ranges of the wide range water levelchannels and the fuel zone water level channels overlap tocover a range of -325 inches (just below the bottom of theactive fuel) to +50 inches (above the normal water level).Reactor vessel water level is measured by separatedifferential pressure transmitters. The output from thesechannels is recorded on two independent pen recorders, whichis the primary indication used by the operator during anaccident. Each recorder has two channels, one for widerange reactor vessel water level and one for fuel zonereactor vessel water level. Therefore, the PAMSpecification deals specifically with these portions of theinstrument channels.

(continued)



BASES

LCO 4. Suppression Chamber Water Level (Wide Range)(continued)

Instruments: LR-8123 A, B

Suppression chamber water level is a Category I variableprovided to detect a breach in the reactor coolant pressureboundary (RCPB). This variable is also used to verify andprovide long term surveillance of ECCS function. The widerange suppression chamber water level measurement providesthe operator with sufficient information to assess thestatus of both the RCPB and the water supply to the ECCS.The wide range water level recorders monitor the suppressionchamber water level from the bottom of the ECCS suctionlines to five feet above normal water level. Two wide rangesuppression chamber water level signals are transmitted fromseparate differential pressure transmitters and arecontinuously recorded on two recorders in the control room.These recorders are the primary indication used by theoperator during an accident. Therefore, the PAMSpecification deals specifically with this portion of theinstrument channel.

5. 6. Drywell Pressure (Wide Range and SubatmosphericRange)

Instruments: Wide Range: PR-8102 A, B (Red Pen)Subatmospheric Range: PR-8102 A, B (Green Pen)

Drywell pressure is a Category I variable provided to detectbreach of the RCPB and to verify ECCS functions that operateto maintain RCS integrity. The wide range andsubatmospheric range drywell pressure channels provide thePAM Drywell Pressure Functions. The wide range andsubatmospheric range drywell pressure channels overlap tocover a range of 5 psia to 225 psig (in excess of four timesthe design pressure of the drywell). Drywell pressuresignals are transmitted from separate pressure transmittersand are continuously recorded and displayed on twoindependent control room recorders. Each recorder has twochannels, one for wide range drywell pressure and one forsubatmospheric range drywell pressure. These recorders arethe primary indication used by the operator during anaccident. Therefore, the PAM Specification dealsspecifically with these portions of the instrument channels.

(continued)



BASES

LCO 7. Drywell High Range Radiation(continued)

Instruments: RR-8103 A, B

Drywell high range radiation is a Category I variableprovided to monitor the potential of significant radiationreleases and to provide release assessment for use byoperators in determining the need to invoke site emergencyplans. Post accident drywell radiation levels are monitoredby four instrument channels each with a range of 1 to 1x10 8

R/hr. These radiation monitors drive two dual channelrecorders located in the control room. Each recorder andthe two associated channels are in a separate division. Assuch, two recorders and two channels of radiation monitoringinstrumentation (one per recorder) are required to beOPERABLE for compliance with this LCO. Therefore, the PAMSpecification deals specifically with these portions of theinstrument channels.

8. Primary Containment Isolation Valve (PCIV) Position

PCIV position is a Category I variable provided forverification of containment integrity. In the case of PCIVposition, the important information is the isolation statusof the containment penetration. The LCO requires onechannel of valve position indication in the control room tobe OPERABLE for each active PCIV in a containmentpenetration flow path, i.e., two total channels of PCIVposition indication for a penetration flow path with twoactive valves. For containment penetrations with only oneactive PCIV having control room indication, Note (b)requires a single channel of valve position indication to beOPERABLE. This is sufficient to redundantly verify theisolation status of each isolable penetration via indicatedstatus of the active valve, as applicable, and priorknowledge of passive valve or system boundary status. If apenetration flow path is isolated, position indication forthe PCIV(s) in the associated penetration flow path is notneeded to determine status. Therefore, the positionindication for valves in an isolated penetration flow pathis not required to be OPERABLE. The PCIV position PAMinstrumentation consists of. position switches, associatedwiring and control room indicating lamps for active PCIVs(check valves and manual valves are not required to haveposition indication). Therefore, the PAM Specificationdeals specifically with these instrument channels.

Each penetration is treated separately and each penetrationflow path is considered a separate function. Therefore,separate condition entry is allowed for each inoperablepenetration flow path.

(continued)



BASES

LCO(continued)

9. 10. Deleted

11. Suppression Chamber Water TemDerature

Instruments: TR-8123 A, BTIS-2-2-71 A, B Recorders

Suppression chamber water temperature is a Category Ivariable provided to detect a condition that couldpotentially lead to containment breach and to verify theeffectiveness of ECCS actions taken to prevent containmentbreach. The suppression chamber water temperatureinstrumentation allows operators to detect trends insuppression chamber water temperature in sufficient time totake action to prevent steam quenching vibrations in thesuppression pool. Suppression chamber water temperature ismonitored by two redundant channels. Each channel isassigned to a separate safeguard power division. Eachchannel consists of 13 resistance temperature detectors(RTDs) mounted in thermowells installed in the suppressionchamber shell below the minimum water level, a processor,and control room recorders. The RTDs are mounted in each of13 of the 16 segments of the suppression chamber. The RTD

(continued)



BASES (continued)

LCO 11. Suppression Chamber Water Temperature (continued)

inputs are averaged by the processor to provide a bulkaverage temperature output to the associated control roomrecorder. The allowance that only 10 RTDs are required tobe OPERABLE for a channel to be considered OPERABLE providedno 2 adjacent RTDs are inoperable is acceptable based onengineering judgement considering the temperature responseprofile of the suppression chamber water volume forpreviously analyzed events and the most challenging RTDsinoperable. These recorders are the primary indication usedby the operator during an accident. Therefore, the PAMSpecification deals specifically with this portion of theinstrument channels. Four recorders are provided. Arecorder in each division is required to be OPERABLE tosatisfy the LCO.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.These variables are related to the diagnosis and preplannedactions required to mitigate DBAs. The applicable DBAs areassumed to occur in MODES 1 and 2. In MODES 3, 4, and 5,plant conditions are such that the likelihood of an eventthat would require PAM instrumentation is extremely low;therefore, PAM instrumentation is not required to beOPERABLE in these MODES.

ACTIONS

A Note has been provided to modify the ACTIONS related toPAM instrumentation channels. Section 1.3, CompletionTimes, specifies that once a Condition has been entered,subsequent divisions, subsystems, components, or variablesexpressed in the Condition discovered to be inoperable ornot within limits, will not result in separate entry intothe Condition. Section 1.3 also specifies that RequiredActions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions for

(continued)



BASES

ACTIONS(continued) inoperable PAM instrumentation channels provide appropriate

compensatory measures for separate Functions. As such, aNote has been provided that allows separate Condition entryfor each inoperable PAM Function.

A.1

When one or more Functions have one required channel that isinoperable, the required inoperable channel must be restoredto OPERABLE status within 30 days. The 30 day CompletionTime is based on operating experience and takes into accountthe remaining OPERABLE channels (or, in the case of aFunction that has only one required channel, othernon-Regulatory Guide 1.97 instrument channels to monitor theFunction), the passive nature of the instrument (no criticalautomatic action is assumed to occur from theseinstruments), and the low probability of an event requiringPAM instrumentation during this interval.

B.1

If a channel has not been restored to OPERABLE status in30 days, this Required Action specifies initiation of actionin accordance with Specification 5.6.6, which requires awritten report to be submitted to the NRC. This reportdiscusses the results of the root cause evaluation of theinoperability and identifies proposed restorative actions.This action is appropriate in lieu of a shutdownrequirement, since alternative actions are identified beforeloss of functional capability, and given the likelihood ofplant conditions that would require information provided bythis instrumentation.

C.1

When one or more Functions have two required channels thatare inoperable (i.e., two channels inoperable in the sameFunction), one channel in the Function should be restored toOPERABLE status within 7 days. The Completion Time of7 days is based on the-relatively low probability of anevent requiring PAM instrument operation and theavailability of alternate means to obtain the requiredinformation. Continuous operation with two required

(continued)



BASES

ACTIONS C.I (continued)

channels inoperable in a Function is not acceptable becausethe alternate indications may not fully meet all performancequalification requirements applied to the PAMinstrumentation. Therefore, requiring restoration of oneinoperable channel of the Function limits the risk that thePAM Function will be in a degraded condition should anaccident occur.

D.1

This Required Action directs entry into the appropriateCondition referenced in Table 3.3.3.1-1. The applicableCondition referenced in the Table is Function dependent.Each time an inoperable channel has not met the RequiredAction of Condition C and the associated Completion Time hasexpired, Condition D is entered for that channel andprovides for transfer to the appropriate subsequentCondition.

E.1

For the majority of Functions in Table 3.3.3.1-1, if theRequired Action and associated Completion Time ofCondition C is not met, the plant must be brought to a MODEin which the LCO not apply. To achieve this status, theplant must be brought to at least MODE 3 within 12 hours.The allowed Completion Times are reasonable, based onoperating experience, to reach the required plant conditionsfrom full power conditions in an orderly manner and withoutchallenging plant systems.

F.1

Since alternate means of monitoring drywell high rangeradiation have been developed and tested, the RequiredAction is not to shut down the plant, but rather to followthe directions of Specification 5.6.6. These alternatemeans may be temporarily installed if the normal PAM channelcannot be restored to OPERABLE status within the allottedtime. The report provided to the NRC should discuss thealternate means used, describe the degree to which thealternate means are equivalent to the installed PAMchannels, justify the areas in which they are notequivalent, and provide a schedule for restoring the normalPAM channels.

(continued).



BASES (continued)


Performance of the CHANNEL CHECK once every 31 days ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel against a similar parameter onother channels. It is based on the assumption thatinstrument channels monitoring the same parameter shouldread approximately the same value. Significant deviationsbetween instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION. The high radiation instrumentationshould be compared to similar plant instruments locatedthroughout the plant.

Agreement criteria are determined by the plant staff, basedon a combination of the channel instrument uncertainties,including isolation, indication, and readability. If achannel is outside the criteria, it may be an indicationthat the sensor or the signal processing equipment hasdrifted outside its limit.

The Frequency of 31 days is based upon plant operatingexperience, with regard to channel OPERABILITY and drift,which demonstrates that failure of more than one channel ofa given Function in any 31 day interval is rare. TheCHANNEL CHECK supplements less formal, but more frequent,checks of channels during normal operational use of thosedisplays associated with the channels required by the LCO.

SR 3.3.3.1.2 Deleted

SR 3.3.3.1.3

These SRs require CHANNEL CALIBRATIONs to be performed. ACHANNEL CALIBRATION is a complete check of the instrumentloop, including the sensor. The test verifies the channelresponds to measured parameter with the necessary range andaccuracy. For the PCIV Position Function, the CHANNELCALIBRATION consists of verifying the remote indicationconforms to actual valve position.

(continued)



BASES


The 24 month Frequency for CHANNEL CALIBRATION of PAMinstrumentation of Table 3.3.3.1-i is based on operatingexperience and consistency with the Peach Bottom AtomicPower Station refueling cycles.

REFERENCES 1. Regulatory Guide 1.97, "Instrumentation for LightWater Cooled Nuclear Power Plants to Assess Plant andEnvirons Conditions Duringand Following an Accident,"Revision 3, May 1983.

2. NRC Safety Evaluation Report, "Peach Bottom AtomicPower Station, Unit Nos. 2 and 3, Conformance toRegulatory Guide 1.97," January 15, 1988.

3. Letter from G. Y. Suh (NRC) to G. J. Beck (PECo) datedFebruary 13, 1991 concerning "Conformance toRegulatory Guide 1.97 for Peach Bottom Atomic PowerStation, Units 2 and 3".

4. Letter from S. Dembek (NRC) to G. A. Hunger (PECOEnergy) dated March 7, 1994 concerning "RegulatoryGuide 1.97 - Boiling Water Reactor Neutron FluxMonitoring, Peach Bottom Atomic Power Station (PBAPS),Units 2 and 3".


Remote Shutdown SystemB 3.3.3.2


B 3.3.3.2 Remote Shutdown System

BASES

BACKGROUND The Remote Shutdown System provides the control roomoperator with sufficient instrumentation and controls toplace and maintain the plant in a safe shutdown conditionfrom a location other than the control room. Thiscapability is necessary to protect against the possibilityof the control room becoming inaccessible. A safe shutdowncondition is defined as MODE 3. With the plant in MODE 3,the Reactor Core Isolation Cooling (RCIC) System, thesafety/relief valves, and the Residual Heat Removal (RHR)Shutdown Cooling System can be used to remove core decayheat and meet all safety requirements. The long term supplyof water for the RCIC and the ability to operate shutdowncooling from outside the control room allow extendedoperation in MODE 3.

In the event that the control room becomes inaccessible, theoperators can establish control at the remote shutdown paneland place and maintain the plant in MODE 3. The plantautomatically reaches MODE 3 following a plant shutdown andcan be maintained safely in MODE 3 for at least I hour. Ifcontrol room operations cannot be resumed within 1 hour, thecontrol capability available at the remote shutdown paneland locally does not prevent cooling down the reactor.

The OPERABILITY of the Remote Shutdown System control andinstrumentation Functions ensures that there is sufficientinformation available on selected plantparameters to placeand maintain the plant in MODE 3 should the control roombecome inaccessible.

APPLICABLE The Remote Shutdown System is required to provideSAFETY ANALYSES instrumentation and controls at appropriate locations

outside the control room with a design capability topromptly shut down the reactor to MODE 3, including thenecessary instrumentation and controls, to maintain theplant in a safe condition in MODE 3.

(continued)



BASES

APPLICABLE The criteria governing the design and the specific systemSAFETY ANALYSES requirements of the Remote Shutdown System are located in

(continued) the UFSAR (Refs. 1 and 2).

The Remote Shutdown System is considered an importantcontributor to reducing the risk of accidents; as such, itmeets Criterion 4 of the NRC Policy Statement.

LCO The Remote Shutdown System LCO provides the requirements forthe OPERABILITY of the instrumentation and controlsnecessary to place and maintain the plant in MODE 3 from alocation other than the control room. The instrumentationand controls required are listed in Table B 3.3.3.2-1.

The controls, instrumentation, and transfer switches arethose required for:

* Reactor pressure vessel (RPV) pressure control;

* Decay heat removal;

• RPV inventory control; and

" Safety support systems for the above functions,including emergency service water (ESW) and emergencyswitch gear.

The Remote Shutdown System is OPERABLE if all instrument andcontrol channels needed to support the remote shutdownfunction are OPERABLE.

The Remote Shutdown System instruments and control circuitscovered by this LCO do not need to be energized to beconsidered OPERABLE. This LCO is intended to ensure thatthe instruments and control circuits will be OPERABLE ifplant conditions require that the Remote Shutdown System beplaced in operation.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1and 2. This is required so that the plant can be placed andmaintained in MODE 3 for an extended period of time from alocation other than the control room.

(continued)



BASES

APPLICABILITY This LCO is not applicable in MODES 3, 4, and 5. In these(continued) MODES, the plant is already subcritical and in a condition

of reduced Reactor Coolant System energy. Under theseconditions, considerable time is available to restorenecessary instrument control Functions if control roominstruments or control becomes unavailable. Consequently,the TS do not require OPERABILITY in MODES 3, 4, and 5.

ACTIONS

A Note has been provided to modify the ACTIONS related toRemote Shutdown System Functions. Section 1.3, CompletionTimes, specifies that once a Condition has been entered,subsequent divisions, subsystems, components, or variablesexpressed in the Condition, discovered to be inoperable ornot within limits, will not result in separate entry intothe Condition. Section 1.3 also specifies that RequiredActions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable Remote Shutdown System Functions provideappropriate compensatory measures for separate Functions.As such, a Note has been provided that allows separateCondition entry for each inoperable Remote Shutdown SystemFunction.

A.1

Condition A addresses the situation where one or morerequired Functions of the Remote Shutdown System isinoperable. This includes the control and transfer switchesfor any required function.

The Required Action is to restore the Function (all requiredchannels) to OPERABLE status within 30 days. The CompletionTime is based on operating experience and the lowprobability of an event that would require evacuation of thecontrol room.

(continued)



BASES

ACTIONS B.1(continued)

If the Required Action and associated Completion Time ofCondition A are not met, the plant must be brought to a MODEin which the LCO does not apply. To achieve this status,the plant must be brought to at least MODE 3 within12 hours. The allowed Completion Time is reasonable, basedon operating experience, to reach the required MODE fromfull power conditions in an orderly manner and withoutchallenging plant systems.


SR 3.3.3.2.1 verifies each required Remote Shutdown Systemtransfer switch and control circuit performs the intendedfunction. This verification is performed from the remoteshutdown panel and locally, as appropriate. Operation ofequipment from the remote shutdown panel is not necessary.The Surveillance can be satisfied by performance of acontinuity check of the circuitry. This will ensure that ifthe control room becomes inaccessible, the plant can beplaced and maintained in MODE 3 from the remote shutdownpanel and the local control stations. The 24 monthFrequency is based on the need to perform this Surveillanceunder the conditions that apply during a plant outage andthe potential for an unplanned transient if the Surveillancewere performed with the reactor at power. Operatingexperience indicates that Remote Shutdown System controlchannels will pass the Surveillance when performed at the24 month Frequency.

SR 3.3.3.2.2

CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. The test verifies the channel respondsto measured parameter values with the necessary range andaccuracy. The 24 month Frequency is based upon operatingexperience and consistency with the plant refueling cycle.

REFERENCES 1. UFSAR, Section 1.5.1.

2. UFSAR, Section 7.18.



Table B 3.3.3.2-1 (page 1 of 3)Remote Shutdown System Instrumentation

FUNCTION REQUIRED NUMBER OF CHANNELS

Instrument Parameter

I. Reactor Pressure 2

2. Reactor Level (Wide Range) 2

3. Torus Temperature 2

4. Torus Level 1

5. Condensate Storage Tank Level 1

6. RCIC Flow I

7. RCIC Turbine Speed I

8. RCIC Pump Suction Pressure I

9. RCIC Pump Discharge Pressure 1

10. RCIC Turbine Supply Pressure 1

11. RCIC Turbine Exhaust Pressure 1

12. "A" ESW Discharge Pressure 1

13. "B" ESW Discharge Pressure 1

14. Drywell Pressure 1

Transfer/Control Parameter

15. RCIC Pump Flow 1

16. RCIC Drain Isolation to Radwaste 1

17. RCIC Steam Pot Drain Steam Trap Bypass 1

18. RCIC Drain Isolation to Main Condenser 1

(continued)





Transfer/Control Parameter (continued)

19. RCIC Exhaust Line Drain Isolation

20. RCIC Steam Isolation

21. RCIC

22. RCIC

Suction from Condensate Storage Tank

Pump Discharge

Minimum Flow

Pump Discharge to Full Flow Test Line

Suction from Torus

23.

24.

25.

26.

27.

28.

29.

30.

31.

32.

33.

RCIC

RCIC

RCIC

2(1/valve)

2

(1/valve)

1

2(1/valve)

1

1

2(1/valve)

1

1

1

1

I

3(1/valve)

RCIC Steam Supply

RCIC Lube Oil Cooler Valve

RCIC Trip Throttle Valve Operator Position

RCIC Trip Throttle Valve Position

RCIC Vacuum Breaker

RCIC Condensate Pump

RCIC Vacuum Pump

Safety/Relief Valves (S/RVs)

34. "A" ESW Pump

35. "B" ESW Pump

I

1

(continued)





Transfer/Control Parameter (continued)

36. "A" CRD Pump

37. "B" CRD Pump

38. RHR Shutdown Cooling Isolation

39. Auto Isolation Reset

40. Instrument Transfer

41.

42.

43.

44.

45.

46.

47.

48.

49.

E222

E322

E242

E342

E224

E212

E312

E232

E332

Breaker

Breaker

Breaker

Breaker

Breaker

Breaker

Breaker

Breaker

Breaker

1

1

2(1/valve)

2(1/division)

5(1/transfer switch)

1

I

1

1

1

1

I

1


ATWS-RPT InstrumentationB 3.3.4.1


B 3.3.4.1 Anticipated Transient Without Scram Recirculation Pump Trip(ATWS-RPT) Instrumentation

BASES

BACKGROUND The ATWS-RPT System initiates an RPT, adding negativereactivity, following events in which a scram does not (butshould) occur, to lessen the effects of an ATWS event.Tripping the recirculation pumps adds negative reactivityfrom the increase in steam voiding in the core area as coreflow decreases. When Reactor Vessel Water Level--Low Low(Level 2) or Reactor Pressure-High setpoint is reached, therecirculation pump drive motor breakers trip.

The ATWS-RPT System includes sensors, relays, and switchesthat are necessary to cause initiation of an RPT. Thechannels include electronic equipment that compares measuredinput signals with pre-established setpoints. When thesetpoint is exceeded, the channel output relay actuates,which then outputs an ATWS-RPT signal to the trip logic.

The ATWS-RPT consists of two trip systems. There are twoATWS-RPT Functions: Reactor Pressure-High and ReactorVessel Water Level-Low Low (Level 2). Each trip system hastwo channels of Reactor Pressure-High and two channels ofReactor Vessel Water Level-Low Low (Level 2). EachATWS-RPT trip system is a one-out-of-two logic for eachFunction. Thus, one Reactor Water Level-Low Low (Level 2)or one Reactor Pressure-High signal is needed to trip atrip system. Both trip systems must be in a trippedcondition to initiate the trip of both recirculation pumps(by tripping the respective recirculation pump drive motorbreakers). There is one recirculation pump drive motorbreaker provided for each of the two recirculation pumps fora total of two breakers.

APPLICABLE The ATWS-RPT is not assumed in the safety analysis. TheSAFETY ANALYSES, ATWS-RPT initiates an RPT to aid in preserving the integrityLCO, and of the fuel cladding following events in which a scram doesAPPLICABILITY not, but should, occur. Based on its contribution to the

reduction of overall plant risk, however, theinstrumentation meets Criterion 4 of the NRC PolicyStatement.

(continued)



BASES


(continued)

The OPERABILITY of the ATWS-RPT is dependent on theOPERABILITY of the individual instrumentation channelFunctions. Each Function must have a required number ofOPERABLE channels in each trip system, with theirsetpoints within the specified Allowable Value ofSR 3.3.4.1.3. The actual setpoint is calibrated consistentwith applicable setpoint methodology assumptions. ChannelOPERABILITY also includes the associated recirculation pumpdrive motor breakers. A channel is inoperable if its actualtrip setting is not within its required Allowable Value.

Allowable Values are specified for each ATWS-RPT Functionspecified in the LCO.' Trip setpoints are specified in thesetpoint calculations. The trip setpoints are selected toensure that the setpoints do not exceed the Allowable Valuebetween CHANNEL CALIBRATIONS. Operation with a trip settingless conservative than the trip setpoint, but within itsAllowable Value, is acceptable. Trip setpoints are thosepredetermined values of output at which an action shouldtake place. The setpoints are compared to the actualprocess parameter (e.g., reactor vessel water level), andwhen the measured output value of the process parameterexceeds the setpoint, the associated device changes state.The analytic or design limits are derived from the limitingvalues of the process parameters obtained from the safetyanalysis. The Allowable Values are derived from theanalytic or design limits, corrected for calibration,process, and instrument errors as well as instrument drift.In selected cases, the Allowable Values and trip setpointsare determined by engineering judgement or historicallyaccepted practice relative to the intended function of thechannel. The trip setpoints determined in this mannerprovide adequate protection by assuring instrument andprocess uncertainties expected for the environments duringthe operating time of the associated channels are accountedfor.

The individual Functions are required to be OPERABLE inMODE I to protect against common mode failures of theReactor Protection System by providing a diverse trip tomitigate the consequences of a postulated ATWS event. TheReactor Pressure-High and Reactor Vessel Water Level--LowLow (Level 2) Functions are required to be OPERABLE inMODE 1 since the reactor is producing significant power and

(continued)



BASES


(continued)

the recirculation system could be at high flow. During thisMODE, the potential exists for pressure increases or lowwater level, assuming an ATWS event. In MODE 2, the reactoris at low power and the recirculation system is at low flow;thus, the potential is low for a pressure increase or lowwater level, assuming an ATWS event. Therefore, theATWS-RPT is not necessary. In MODES 3 and 4, the reactor isshut down with all control rods inserted; thus, an ATWSevent is not significant and the possibility of asignificant pressure increase or low water level isnegligible. In MODE 5, the one rod out interlock ensuresthat the reactor remains subcritical; thus, an ATWS event isnot significant. In addition, the reactor pressure vessel(RPV) head is not fully tensioned and no pressure transientthreat to the reactor coolant pressure boundary (RCPB)exists.

The specific Applicable Safety Analyses and LCO discussionsare listed below on a Function by Function basis.

a. Reactor Vessel Water Level-Low Low (Level 2)

Low RPV water level indicates that a reactor scramshould have occurred and the capability to cool thefuel may be threatened. Should RPV water leveldecrease too far, fuel damage could result. TheATWS-RPT System is initiated at Level 2 to assist inthe mitigation of the ATWS event. The resultantreduction of core flow reduces the neutron flux andTHERMAL POWER and, therefore, the rate of coolantboiloff.

Reactor vessel water level signals are initiated fromfour level transmitters that sense the differencebetween the pressure due to a constant column of water(reference leg) and the pressure due to the actualwater level (variable leg) in the vessel.

Four channels of Reactor Vessel Water Level--Low Low(Level 2), with two channels in each trip system, areavailable and required to be OPERABLE to ensure thatno single instrument failure can preclude an ATWS-RPTfrom this Function on a valid signal. The ReactorVessel Water Level-Low Low (Level 2) Allowable Value

(continued)



BASES


a. Reactor Vessel Water Level-Low Low (Level 2)(continued)

is chosen so that the system will not be initiatedafter a Level 3 scram with feedwater still available,and for convenience with the reactor core isolationcooling initiation.

b. Reactor Pressure-Hiah

Excessively high RPV pressure may rupture the RCPB.An increase in the RPV pressure during reactoroperation compresses the steam voids and results in apositive reactivity insertion. This increases neutronflux and THERMAL POWER, which could potentially resultin fuel failure and overpressurization. The ReactorPressure-High Function initiates an RPT for transientsthat result in a pressure increase, counteracting thepressure increase by rapidly reducing core powergeneration. For the overpressurization event, the RPTaids in the termination of the ATWS event and, alongwith the safety/relief valves, limits the peak RPVpressure to less than the ASME Section III Codelimits.

The Reactor Pressure-High signals are initiated fromfour pressure transmitters that monitor reactor steamdome pressure. Four channels of Reactor Pressure-High, with two channels in each trip system, areavailable and are required to be OPERABLE to ensurethat no single instrument failure can preclude anATWS-RPT from this Function on a valid signal. TheReactor Pressure-High Allowable Value is chosen toprovide an adequate margin to the ASME Section IIICode limits.

ACTIONS A Note has been provided to modify the ACTIONS related toATWS-RPT instrumentation channels. Section 1.3, CompletionTimes, specifies that once a Condition has been entered,subsequent divisions, subsystems, components, or variablesexpressed in the Condition, discovered to be inoperable ornot within limits, will not result in separate entry intothe Condition. Section 1.3 also specifies that RequiredActions of the Condition continue to apply for each

(continued)



BASES

ACTIONS additional failure, with Completion Times based on initial(continued) entry into the Condition. However, the Required Actions for

inoperable ATWS-RPT instrumentation channels provideappropriate compensatory measures for separate inoperablechannels. As such, a Note has been provided that allowsseparate Condition entry for each inoperable ATWS-RPTinstrumentation channel.

A.1 and A.2

With one or more channels inoperable, but with ATWS-RPT tripcapability for each Function maintained (refer to RequiredActions B.1 and C.1 Bases), the ATWS-RPT System is capableof performing the intended function. However, thereliability and redundancy of the ATWS-RPT instrumentationis reduced, such that a single failure in the remaining tripsystem could result in the inability of the ATWS-RPT Systemto perform the intended function. Therefore, only a limitedtime is allowed to restore the inoperable channels toOPERABLE status. Because of the diversity of sensorsavailable to provide trip signals, the low probability ofextensive numbers of inoperabilities affecting all diverseFunctions, and the low probability of an event requiring theinitiation of ATWS-RPT, 14 days is provided to restore theinoperable channel (Required Action A.1). Alternately, theinoperable channel may be placed in trip (RequiredAction A.2), since this would conservatively compensate forthe inoperability, restore capability to accommodate asingle failure, and allow operation to continue. As noted,placing the channel in trip with no further restrictions isnot allowed if the inoperable channel is the result of aninoperable breaker, since this may not adequately compensatefor the inoperable breaker (e.g., the breaker may beinoperable such that it will not open). If it is notdesired to place the channel in trip (e.g., as in the casewhere placing the inoperable channel would result in anRPT), or if the inoperable channel is the result of aninoperable breaker, Condition D must be entered and itsRequired Actions taken.

B.1

Required Action B.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in the Function not

(continued)


ATWS-RPT Instrumentation

B 3.3.4.1

BASES

ACTIONS B.I (continued)

maintaining ATWS-RPT trip capability. A Function isconsidered to be maintaining ATWS-RPT trip capability whensufficient channels are OPERABLE or in trip such that theATWS-RPT System will generate a trip signal from the givenFunction on a valid signal, and both recirculation pumps canbe tripped. This requires one channel of the Function ineach trip system to be OPERABLE or in trip, and therecirculation pump drive motor breakers to be OPERABLE or intrip.

The 72*hour Completion Time is sufficient for the operatorto take corrective action (e.g., restoration or tripping ofchannels) and takes into account the likelihood of an eventrequiring actuation of the ATWS-RPT instrumentation duringthis period and that one Function is still maintainingATWS-RPT trip capability.

C.1

Required Action C.1 is intended to ensure that appropriateActions are taken if multiple, inoperable, untrippedchannels within both Functions result in both Functions notmaintaining ATWS-RPT trip capability. The description of aFunction maintaining ATWS-RPT trip capability is discussedin the Bases for Required Action B.1 above.

The I hour Completion Time is sufficient for the operator totake corrective action and takes into account the likelihoodof an event requiring actuation of the ATWS-RPTinstrumentation during this period.

D.1 and D.2

With any Required Action and associated Completion Time notmet, the plant must be brought to a MODE or other specifiedcondition in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 2 within6 hours (Required Action D.2). Alternately, the associatedrecirculation pump may be removed from service since thisperforms the intended function of the instrumentation(Required Action D.1). The allowed Completion Time of

(continued)



BASES

ACTIONS D.1 and D.2 (continued)

6 hours is reasonable, based on operating experience, bothto reach MODE 2 from full power conditions and to remove arecirculation pump from service in an orderly manner andwithout challenging plant systems.

Required Action D.1 is modified by a Note which states thatthe Required Action is only applicable if the inoperablechannel is the result of an inoperable RPT breaker. TheNote clarifies the situations under which the associatedRequired Action would be the appropriate Required Action.


The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into theassociated Conditions and Required Actions may be delayedfor up to 6 hours provided the associated Function maintainsATWS-RPT trip capability. Upon completion of theSurveillance, or expiration of the 6 hour allowance, thechannel must be returned to OPERABLE status or theapplicable Condition entered and Required Actions taken.This Note is based on the reliability analysis (Ref. 1)assumption of the average time required to perform channelSurveillance. That analysis demonstrated that the 6 hourtesting allowance does not significantly reduce theprobability that the recirculation pumps will trip whennecessary.

SR 3.3.4.1.1

Performance of the CHANNEL CHECK once every 12 hours ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween the instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION.


(continued)



BASES


The Frequency is based upon operating experience thatdemonstrates channel failure is rare. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannels during normal operational use of the displaysassociated with the required channels of this LCO.

SR 3.3.4.1.2

A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function. Any setpoint adjustment shall beconsistent with the assumptions of the current plantspecific setpoint methodology.

The Frequency of 92 days is based on the reliabilityanalysis of Reference 1.

SR 3.3.4.1.3

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the assumptions of the currentplant specific setpoint methodology.


SR 3.3.4.1.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required trip logic for a specificchannel. The system functional test of the pump breakers isincluded as part of this Surveillance and overlaps the LOGICSYSTEM FUNCTIONAL TEST to provide complete testing of theassumed safety function. Therefore, if a breaker isincapable of operating, the associated instrument channel(s)would be inoperable.

(continued)



BASES


The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown these components will passthe Surveillance when performed at the 24 month Frequency.

REFERENCES 1. GENE-770-06-1, "Bases for Changes To Surveillance TestIntervals and Allowed Out-of-Service Times ForSelected Instrumentation Technical Specifications,"February 1991.


EOC-RPT InstrumentationB 3.3.4.2

S B 3.3 INSTRUMENTATION

B 3.3.4.2 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation

BASES

BACKGROUND The EOC-RPT instrumentation initiates a recirculation pumptrip (RPT) to reduce the peak reactor pressure and powerresulting from turbine trip or generator load rejectiontransients and to minimize the decrease in core MCPR duringthese transients.

The benefit of the additional negative reactivity in excessof that normally inserted on a scram reflects end of cyclereactivity considerations. Flux shapes at the end of cycleare such that the control rods insert only a small amount ofnegative reactivity during the first few feet of rod travelupon a scram caused by Turbine Control Valve (TCV) FastClosure, Trip Oil Pressure-Low or Turbine Stop Valve(TSV)-Closure. The physical phenomenon involved is thatthe void reactivity feedback due to a pressurizationtransient can add positive reactivity at a faster rate thanthe control rods can add negative reactivity.

The EOC-RPT instrumentation, as shown in Reference 1, iscomposed of sensors that detect initiation of closure of theTSVs or fast closure of the TCVs, combined with relays,logic circuits, and fast acting circuit breakers thatinterrupt power from the recirculation pump motor generator(MG) set generators to each of the recirculation pumpmotors. When the setpoint is exceeded, the channel outputrelay actuates, which then outputs an EOC-RPT signal to thetrip logic. When the RPT breakers trip open, therecirculation pumps coast down under their own inertia. TheEOC-RPT has two identical trip systems, either of which canactuate an RPT.

Each EOC-RPT trip system is a two-out-of-two logic for eachFunction; thus, either two TSV-Closure or two TCV FastClosure, Trip Oil Pressure-Low signals are required for atrip system to actuate. If either trip system actuates,both recirculation pumps will trip. There are two EOC-RPTbreakers in series per recirculation pump. One trip systemtrips one of the two EOC-RPT breakers for each recirculation

(continued)



BASES


pump, and the second trip system trips the other EOC-RPTbreaker for each recirculation pump.


The TSV-Closure and the TCV Fast Closure, Trip OilPressure-Low Functions are designed to trip therecirculation pumps in the event of a turbine trip orgenerator load rejection to mitigate the neutron flux, heatflux, and pressurization transients, and to minimize thedecrease in MCPR. The analytical methods and assumptionsused in evaluating the turbine trip and generator loadrejection, as well as other safety analyses that utilizeEOC-RPT, are summarized in References 2, 3, and 4.

To mitigate pressurization transient effects, the EOC-RPTmust trip the recirculation pumps after initiation ofclosure movement of either the TSVs or the TCVs" Thecombined effects of this trip and a scram reduce fuel bundlepower more rapidly than a scram alone so that the SafetyLimit MCPR is not exceeded. Alternatively, APLHGR operatinglimits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATIONRATE (APLHGR)"), the MCPR operating limits (LCO 3.2.2,"MINIMUM CRITICAL POWER RATIO (MCPR)"), and the LHGRoperating limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE(LHGR)") for an inoperable EOC-RPT, as specified in theCOLR, are sufficient to allow this LCO to be met. The EOC-RPT function is automatically disabled when turbine firststage pressure is < 29.5% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRCPolicy Statement.

The OPERABILITY of the EOC-RPT is dependent on theOPERABILITY of the individual instrumentation channelFunctions, i.e., the TSV-Closure and the TCV Fast Closure,Trip Oil Pressure-Low Functions. Each Function must have arequired number of OPERABLE channels in each trip system,with their setpoints within the specified Allowable Value ofSR 3.3.4.2.3. Channel OPERABILITY also includes theassociated EOC-RPT breakers. Each channel (including theassociated EOC-RPT breakers) must also respond within itsassumed response time.

Allowable Values are specified for each EOC-RPT Functionspecified in the LCO. Trip setpoints are specified in theplant design documentation. The trip setpoints are selected

(continued)



BASES


(continued)

to ensure that the actual setpoints do not exceed theAllowable Value between successive CHANNEL CALIBRATIONS.Operation with a trip setpoint less conservative than thetrip setpoint, but within its Allowable Value, isacceptable. A channel is inoperable if its actual tripsetting is not within its required Allowable Value. Tripsetpoints are those predetermined values of output at whichan action should take place. The setpoints are compared tothe actual process parameters (e.g. TSV position), and whenthe measured output value of the process parameter exceedsthe setpoint, the associated device (e.g., limit switch)changes state. The analytic limit for the TCV Fast Closure,Trip Oil Pressure-Low Function was determined based on theTCV hydraulic oil circuit design. The Allowable Value isderived from the analytic limit, corrected for calibration,process, and instrument errors. The trip setpoint isdetermined from the analytical limit corrected forcalibration, process, and instrumentation errors, as well asinstrument drift, as applicable. The Allowable Value andtrip setpoint for the TSV-Closure Function was determined byengineering judgment and historically accepted practice forsimilar trip functions.

The specific Applicable Safety Analysis, LCO, andApplicability discussions are listed below on a Function byFunction basis.

Alternatively, since the instrumentation protects against aMCPR SL violation, with the instrumentation inoperable,modifications to the APLHGR operating limits (LCO 3.2.1,"AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), theMCPR operating limits (LCO 3.2.2, "MINIMUM CRITICAL POWERRATIO (MCPR)"), and the LHGR operating limits (LCO 3.2.3,"LINEAR HEAT GENERATION RATE (LHGR)") may be applied toallow this LCO to be met. The appropriate MCPR operatinglimits and power-dependent thermal limit adjustments for theEOC-RPT inoperable condition are specified in the COLR.

Turbine Stop Valve-Closure

Closure of the TSVs and a main turbine trip result in theloss of a heat sink that produces reactor pressure, neutronflux, and heat flux transients that must be limited.Therefore, an RPT is initiated on TSV-Closure inanticipation of the transients that would result fromclosure of these valves. EOC-RPT decreases peak reactorpower and aids the reactor scram in ensuring that the MCPRSL is not exceeded during the worst case transient.

(continued)

PBAPS UNIT 2 B 3.3-91c Revision No. 49


BASES

APPLICABLESAFETY ANALYSIS,LCO, andAPPLICABILITY

Turbine Stop Valve-Closure (continued)

Closure of the TSVs is determined by measuring the positionof each valve. There are position switches associated witheach stop valve, the signal from each switch being assignedto a separate trip channel. The logic for the TSV-ClosureFunction is such that two or more TSVs must be closed toproduce an EOC-RPT. This Function must be enabled atTHERMAL POWER Ž 29.5% RTP as measured at the turbine firststage pressure. This is normally accomplished automaticallyby pressure switches sensing turbine first stage pressure;therefore, opening of the turbine bypass valves may affectthis Function. Four channels of TSV-Closure, with twochannels in each trip system, are available and required tobe OPERABLE to ensure that no single instrument failure willpreclude an EOC-RPT from this Function on a valid signal.The TSV-Closure Allowable Value is selected to detectimminent TSV closure.

This EOC-RPT Function is required, consistent with thesafety analysis assumptions, whenever THERMAL POWER isŽ 29.5% RTP. Below 29.5% RTP, the Reactor Pressure-High andthe Average Power Range Monitor (APRM) Scram Clamp Functionsof the Reactor Protection System (RPS) are adequate tomaintain the necessary safety margins.

Turhine Control Valvp Fast Cln suro - Trin nil Pressuro - Low

Fast closure of the TCVs during a generator load rejectionresults in the loss of a heat sink that produces reactorpressure, neutron flux, and heat flux transients that mustbe limited. Therefore, an RPT is initiated on TCV FastClosure, Trip Oil Pressure-Low in anticipation of thetransients that would result from the closure of thesevalves. The EOC-RPT decreases peak reactor power and aidsthe reactor scram in ensuring that the MCPR SL is notexceeded during the worst case transient.

Fast closure of the TCVs is determined by measuring theelectrohydraulic control fluid pressure at each controlvalve. There is one pressure switch associated with eachcontrol valve, and the signal from each switch is assignedto a separate trip channel. The logic for the TCV FastClosure, Trip Oil Pressure-Low Function is such that two ormore TCVs must be closed (pressure switch trips)

(continued)

PBAPS UNIT 2 B 3.3-91d Revision No. 43


BASES

APPLICABLESAFETY ANALYSISLCO, andAPPLICABILITY

Turbine Control Valve Fast Closure, Trip Oil Pressure-Low(continued)

to produce an EOC-RPT. This Function must be enabled atTHERMAL POWER Ž 29.5% RTP as measured at the turbine firststage pressure. This is normally accomplishedautomatically by pressure switches sensing turbine firststage pressure; therefore, opening of the turbine bypassvalves may affect this Function. Four channels of TCV FastClosure, Trip Oil Pressure-Low, with two channels in eachtrip system, are available and required to be OPERABLE toensure that no single instrument failure will preclude anEOC-RPT from this Function on a valid signal. The TCV FastClosure, Trip Oil Pressure-Low Allowable Value is selectedhigh enough to detect imminent TCV fast closure.

This protection is required consistent with the safetyanalysis whenever THERMAL POWER is Ž 29.5% RTP. Below29.5% RTP, the Reactor Pressure-High and the APRM ScramClamp Functions of the RPS are adequate to maintain thenecessary safety margins.

ACTIONS A Note has been provided to modify the ACTIONS related toEOC-RPT instrumentation channels. Section 1.3, CompletionTimes, specifies that once a Condition has been entered,subsequent divisions, subsystems, components, or variablesexpressed in the Condition, discovered to be inoperable ornot within limits, will not result in separate entry intothe Condition. Section 1.3 also specifies that RequiredActions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable EOC-RPT instrumentation channels provideappropriate compensatory measures for separate inoperablechannels. As such, a Note has been provided that allowsseparate Condition entry for each inoperable EOC-RPTinstrumentation channel.

(continued)

PBAPS UNIT 2 B 3.3-91e Revision No. 43


BASES

ACTIONS A.1 and A.2(continued)

With one or more required channels inoperable, but withEOC-RPT trip capability maintained (refer to RequiredAction B.1 Bases), the EOC-RPT System is capable ofperforming the intended function. However, the reliabilityand redundancy of the EOC-RPT instrumentation is reducedsuch that a single failure in the remaining trip systemcould result in the inability of the EOC-RPT System toperform the intended function. Therefore, only a limitedtime is allowed to restore compliance with the LCO. Becauseof the diversity of sensors available to provide tripsignals, the low probability of extensive numbers ofinoperabilities affecting all diverse Functions, and the lowprobability of an event requiring the initiation of anEOC-RPT, 72 hours is provided to restore the inoperablechannels (Required Action A.1). Alternately, the inoperablechannels may be placed in trip (Required Action A.2) sincethis would conservatively compensate for the inoperability,restore capability to accommodate a single failure, andallow operation to continue. As noted in Required ActionA.2, placing the channel in trip with no furtherrestrictions is not allowed if the inoperable channel is theresult of an inoperable breaker, since this may notadequately compensate for the inoperable breaker (e.g., thebreaker may be inoperable such that it will not open). Ifit is not desired to place the channel in trip (e.g., as inthe case where placing the inoperable channel in trip wouldresult in an RPT, or if the inoperable channel is the resultof an inoperable breaker), Condition C must be entered andits Required Actions taken.

B.1

Required Action B.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in the Function notmaintaining EOC-RPT trip capability. A Function isconsidered to be maintaining EOC-RPT trip capability whensufficient channels are OPERABLE or in trip, such that theEOC-RPT System will generate a trip signal from the givenFunction on a valid signal and both recirculation pumps canbe tripped. This requires two channels of the Function inthe same trip system, to each be OPERABLE or in trip, andthe associated EOC-RPT breakers to be OPERABLE.

(continued)

PBAPS UNIT 2 B 3.3-91f Revision No. 57


BASES


The 2 hour Completion Time is sufficient time for theoperator to take corrective action, and takes into accountthe likelihood of an event requiring actuation of theEOC-RPT instrumentation during this period. It is alsoconsistent with the 2 hour Completion Time provided inLCO 3.2.1 and 3.2.2 for Required Action A.1, since thisinstrumentation's purpose is to preclude a thermal limitviolation.

C.1 and C.2

With any Required Action and associated Completion Time notmet, THERMAL POWER must be reduced to < 29.5% RTP within4 hours. Alternately, for an inoperable breaker (e.g., thebreaker may be inoperable such that it will not open) theassociated recirculation pump may be removed from service,since this performs the intended function of theinstrumentation. The allowed Completion Time of 4 hours isreasonable, based on operating experience, to reduce THERMALPOWER to < 29.5% RTP from full power conditions in anorderly manner and without challenging plant systems.

Required Action C.1 is modified by a Note which states thatthe Required Action is only applicable if the inoperablechannel is the result of an inoperable RPT breaker. TheNote clarifies the situations under which the associatedRequired Action would be the appropriate Required Action.


The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may be delayed for up to6 hours provided the associated Function maintains EOC-RPTtrip capability. Upon completion of the Surveillance, orexpiration of the 6 hour allowance, the channel must bereturned to OPERABLE status or the applicable Conditionentered and Required Actions taken. This Note is based onthe reliability analysis (Ref. 5) assumption of the averagetime required to perform channel Surveillance. Thatanalysis demonstrated that the 6 hour testing allowance doesnot significantly reduce the probability that therecirculation pumps will trip when necessary.

(continued)

PBAPS UNIT 2 B 3.3-91g Revision No. 57


BASES


(continued) A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function.

The Frequency of 92 days is based on reliability analysis ofReference 5.

SR 3.3.4.2.2

CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations consistent with the plant specific setpointmethodology.


SR 3.3.4.2.3

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required trip logic for a specificchannel. The system functional test of the pump breakers isincluded as a part of this test, overlapping the LOGICSYSTEM FUNCTIONAL TEST, to provide complete testing of theassociated safety function. Therefore, if a breaker isincapable of operating, the associated instrument channel(s)would also be inoperable.

The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown these components usually passthe Surveillance when performed at the 24 month Frequency.

(continued)

PBAPS UNIT 2 B 3.3-91h Revision No. 25


BASES


(continued)

SR 3.3.4.2.4

This SR ensures that an EOC-RPT initiated from theTSV-Closure and TCV Fast Closure, Trip Oil Pressure-LowFunctions will not be inadvertently bypassed when THERMALPOWER is _> 29.5% RTP. This involves calibration of thebypass channels. Adequate margins for the instrumentsetpoint methodologies are incorporated into the actualsetpoint. Because main turbine bypass flow can affect thissetpoint nonconservatively (THERMAL POWER is derived fromfirst stage pressure) the main turbine bypass valves mustremain closed during the calibration at THERMAL POWER_> 29.5% RTP to ensure that the calibration remains valid. Ifany bypass channel's setpoint is nonconservative (i.e., theFunctions are bypassed at _> 29.5% RTP, either due to openmain turbine bypass valves or other reasons), the affectedTSV-Closure and TCV Fast Closure, Trip Oil Pressure-LowFunctions are considered inoperable. Alternatively, thebypass channel can be placed in the conservative condition(nonbypass). If placed in the nonbypass condition, this SRis met with the channel considered OPERABLE.

The Frequency of 24 months is based on engineering judgementand reliability of the components.

SR 3.3.4.2.5

This SR ensures that the individual channel response timesare less than or equal to the maximum values assumed in theaccident analysis. The EOC-RPT SYSTEM RESPONSE TIMEacceptance criterion is included in Reference 6.

A Note to the Surveillance states that breaker interruptiontime may be assumed from the most recent performance ofSR 3.3.4.2.6. This is allowed since the time to open thecontacts after energization of the trip coil and the arcsuppression time are short and do not appreciably change,due to the design of the breaker opening device and the factthat the breaker is not routinely cycled.

(continued)

PBAPS UNIT 2 B 3.3-91i Revision No. 43


BASES


EOC-RPT SYSTEM RESPONSE TIME tests are conducted on a24 month STAGGERED TEST BASIS. Response times cannot bedetermined at power because operation of final actuateddevices is required. Therefore, the 24 month Frequency isconsistent with the typical industry refueling cycle and isbased upon plant operating experience, which shows thatrandom failures of instrumentation components that causeserious response time degradation, but not channel failure,are infrequent occurrences.

SR 3.3.4.2.6

This SR ensures that the RPT breaker interruption time (arcsuppression time plus time to open the contacts) is providedto the EOC-RPT SYSTEM RESPONSE TIME test. The 60 monthFrequency of the testing is based on the difficulty ofperforming the test and the reliability of the circuitbreakers.

REFERENCES 1. UFSAR, Figure 7.9.4A, Sheet 3 of 3 (EOC-RPT logic

diagram).

2. UFSAR, Section 7.9.4.4.3.


4. NEDE-24011-P-A, "General Electric Standard Applicationfor Reactor Fuel," latest approved version.

5. GENE-770-06-I-A, "Bases for Changes to SurveillanceTest Intervals and Allowed Out-Of-Service Times forSelected Instrumentation Technical Specifications,"December 1992.

6. Core Operating Limits Report.

PBAPS UNIT 2 B 3.3-91j Revision No. 25

ECCS InstrumentationB 3.3.5.1


B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation

BASES

BACKGROUND The purpose of the ECCS instrumentation is to initiateappropriate responses from the systems to ensure that thefuel is adequately cooled in the event of a design basisaccident or transient.

For most abnormal operational transients and Design BasisAccidents (DBAs), a wide range of dependent and independentparameters are monitored.

The ECCS instrumentation actuates core spray (CS), lowpressure coolant injection (LPCI), high pressure coolantinjection (HPCI), Automatic Depressurization System (ADS),and the diesel generators (DGs). The equipment involvedwith each of these systems is described in the Bases forLCO 3.5.1, "ECCS-Operating."

Core Spray System

The CS System may be initiated by automatic means.Automatic initiation occurs for conditions of Reactor VesselWater Level-Low Low Low (Level 1) or Drywell Pressure-Highwith a Reactor Pressure-Low permissive. The reactor vesselwater level and the reactor pressure variables are monitoredby four redundant transmitters, which are, in turn,connected to four pressure compensation instruments. Thedrywell pressure variable is monitored by four redundanttransmitters, which are, in turn, connected to four tripunits. The outputs of the pressure compensation instrumentsand the trip units are connected to relays which sendsignals to two trip systems, with each trip system arrangedin a one-out-of-two taken twice logic (each trip unit sendsa signal to both trip systems.) Each trip system initiatestwo of the four CS pumps.

Upon receipt of an initiation signal, if normal AC power isavailable, CS pumps A and C start after a time delay ofapproximately 13 seconds and CS pumps B and D start after atime delay of approximately 23 seconds. If normal AC poweris not available, the four CS pumps start simultaneouslyafter a time delay of approximately 6 seconds after therespective DG is ready to load.

(continued)



BASES

BACKGROUND Core Spray System (continued)

The CS test line isolation valve, which is also a primarycontainment isolation valve (PCIV), is closed on a CSinitiation signal to allow full system flow assumed in theaccident analyses and maintain primary containment isolatedin the event CS is not operating.

The CS pump discharge flow is monitored by a differentialpressure indicating switch. When the pump is running anddischarge flow is low enough so that pump overheating mayoccur, the minimum flow return line valve is opened. Thevalve is automatically closed if flow is above the minimumflow setpoint to allow the full system flow assumed in theaccident analysis.

The CS System also monitors the pressure in the reactor toensure that, before the injection valves open, the reactorpressure has fallen to a value below the CS System's maximumdesign pressure. The variable is monitored by fourredundant transmitters, which are, in turn, connected tofour pressure compensation instruments. The outputs of thepressure compensation instruments are connected to relayswhose contacts are arranged in a one-out-of-two taken twicelogic.

Low Pressure Coolant Injection System

The LPCI is an operating mode of the Residual Heat Removal(RHR) System, with two LPCI subsystems. The LPCI subsystemsmay be initiated by automatic means. Automatic initiationoccurs for conditions of Reactor Vessel Water Level--Low LowLow (Level 1); Drywell Pressure-High with a ReactorPressure-Low (Injection Permissive). The drywell pressurevariable is monitored by four redundant transmitters, which,in turn, are connected to four trip units. The reactorvessel water level and the reactor pressure variables aremonitored by four redundant transmitters, which are, inturn, connected to four pressure compensation instruments.The outputs of the trip units and pressure compensationinstruments are connected to relays which send signals totwo trip systems, with each trip system arranged in a one-out-of-two taken twice logic (each trip unit sends a signalto both trip systems). Each trip system can initiate allfour LPCI pumps.

(continued)



BASES

BACKGROUND Low Pressure Coolant Injection System (continued)

Upon receipt of an initiation signal if normal AC power isavailable, the LPCI A and B pumps start after a delay ofapproximately 2 seconds. The LPCI C and D pumps are startedafter a delay of approximately 8 seconds. If normal ACpower is not available, the four LPCI pumps startsimultaneously with no delay as soon as the standby powersource is available.

Each LPCI subsystem's discharge flow is monitored by adifferential pressure indicating switch. When a pump isrunning and discharge flow is low enough so that pumpoverheating may occur, the respective minimum flow returnline valve is opened. If flow is above the minimum flowsetpoint, the valve is automatically closed to allow thefull system flow assumed in the analyses.

The RHR test line suppression pool cooling isolation valve,suppression pool spray isolation valves, and containmentspray isolation valves (which are also PCIVs) are alsoclosed on a LPCI initiation signal to allow the full systemflow assumed in the accident analyses and maintain primarycontainment isolated in the event LPCI is not operating.

The LPCI System monitors the pressure in the reactor toensure that, before an injection valve opens, the reactorpressure has fallen to a value below the LPCI System'smaximum design pressure. The variable is monitored by fourredundant transmitters, which are, in turn, connected tofour pressure compensation instruments. The outputs of thepressure compensation instruments are connected to relayswhose contacts are arranged in a one-out-of-two taken twicelogic. Additionally, instruments are provided to close therecirculation pump discharge valves to ensure that LPCI flowdoes not bypass the core when it injects into therecirculation lines. The variable is monitored by fourredundant transmitters, which are, in turn, connected tofour pressure compensation instruments. The outputs of thepressure compensation instruments are connected to relayswhose contacts are arranged in a one-out-of-two taken twicelogic.

(continued)



BASES

BACKGROUND Low Pressure Coolant Injection System (continued)

Low reactor water level in the shroud is detected by twoadditional instruments. When the level is greater than thelow level setpoint LPCI may no longer be required, thereforeother modes of RHR (e.g., suppression pool cooling) areallowed. Manual overrides for the isolations below the lowlevel setpoint are provided.

High Pressure Coolant Injection System

The HPCI System may be initiated by automatic means.Automatic initiation occurs for conditions of Reactor VesselWater Level-Low Low (Level 2) or Drywell Pressure-High.The reactor vessel water level variable is monitored by fourredundant transmitters, which are, in turn, connected tofour pressure compensation instruments. The drywellpressure variable is monitored by four redundanttransmitters, which are, in turn, connected to four tripunits. The outputs of the pressure compensation instrumentsand the trip units are connected to relays whose contactsare arranged in a one-out-of-two taken twice logic for eachFunction.

The HPCI pump discharge flow is monitored by a flow switch.When the pump is running and discharge flow is low enough sothat pump overheating may occur, the minimum flow returnline valve is opened. The valve is automatically closed ifflow is above the minimum flow setpoint to allow the fullsystem flow assumed in the safety analysis.

The HPCI test line isolation valve (which is also a PCIV) isclosed upon receipt of a HPCI initiation signal to allow thefull system flow assumed in the accident analysis andmaintain primary containment isolated in the event HPCI isnot operating.

The HPCI System also monitors the water levels in thecondensate storage tank (CST) and the suppression poolbecause these are the two sources of water for HPCIoperation. Reactor grade water in the CST is the normalsource. Upon receipt of a HPCI initiation signal, the CST

(continued)



BASES

BACKGROUND High Pressure Coolant Injection System (continued)

suction valve is automatically signaled to open (it isnormally in the open position) unless both suppression poolsuction valves are open. If the water level in the CSTfalls below a preselected level, first the suppression poolsuction valves automatically open, and then the CST suctionvalve automatically closes. Two level switches are used todetect low water level in the CST. Either switch can causethe suppression pool suction valves to open and the CSTsuction valve to close. The suppression pool suction valvesalso automatically open and the CST suction valve closes ifhigh water level is detected in the suppression pool. Toprevent losing suction to the pump, the suction valves areinterlocked so that one suction path must be open before theother automatically closes.

The HPCI provides makeup water to the reactor until thereactor vessel water level reaches the Reactor Vessel WaterLevel-High (Level 8) trip, at which time the HPCI turbinetrips, which causes the turbine's stop valve and the controlvalves to close. The logic is two-out-of-two to providehigh reliability of the HPCI System. The HPCI Systemautomatically restarts if a Reactor Vessel Water Level-LowLow (Level 2) signal is subsequently received.

Automatic Depressurization System

The ADS may be initiated by automatic means. Automaticinitiation occurs when signals indicating Reactor VesselWater Level--Low Low Low (Level 1); Drywell Pressure-Highor ADS Bypass Low Water Level Actuation Timer; ReactorVessel Water Confirmatory Level-Low (Level 4); and CS orLPCI Pump Discharge Pressure-High are all present and theADS Initiation Timer has timed out. There are twotransmitters each for Reactor Vessel Water Level--Low LowLow (Level 1) and Drywell Pressure-High, and onetransmitter for Reactor Vessel Water Confirmatory Level--Low(Level 4) in each of the two ADS trip systems. Each ofthese transmitters connects to a trip unit, which thendrives a relay whose contacts form the initiation logic.

Each ADS trip system includes a time delay betweensatisfying the initiation logic and the actuation of the ADSvalves. The ADS Initiation Timer time delay setpoint chosenis long enough that the HPCI has sufficient operating time

(continued)



BASES

BACKGROUND Automatic Depressurization System (continued)

to recover to a level above Level 1, yet not so long thatthe LPCI and CS Systems are unable to adequately cool thefuel if the HPCI fails to maintain that level. An alarm inthe control room is annunciated when either of the timers istiming. Resetting the ADS initiation signals resets the ADSInitiation Timers.

The ADS also monitors the discharge pressures of the fourLPCI pumps and the four CS pumps. Each ADS trip systemincludes two discharge pressure permissive switches from allfour LPCI pumps and one discharge pressure permissive switchfrom all four CS pumps. The signals are used as apermissive for ADS actuation, indicating that there is asource of core coolant available once the ADS hasdepressurized the vessel. Two CS pumps in propercombination (C or D and A or B) or any one of the four LPCIpumps is sufficient to permit automatic depressurization.

The ADS logic in each trip system is arranged in twostrings. Each string has a contact from each of thefollowing variables: Reactor Vessel Water Level--Low LowLow (Level 1); Drywell Pressure-High; Low Water LevelActuation Timer; and Reactor Vessel Water Level--Low Low Low(Level 1) Permissive. One of the two strings in each tripsystem must also have a Reactor Vessel Water ConfirmatoryLevel--Low (Level 4). After the contacts for the initiationsignal from either drywell pressure or reactor vessel level(and the timer for reactor vessel level timing out) close,the following must be present to initiate an ADS tripsystem: all other contacts in both logic strings mustclose, the ADS initiation timer must time out, and a CS orLPCI pump discharge pressure signal must be present. Eitherthe A or B trip system will cause all the ADS relief valvesto open. Once the Drywell Pressure-High signal, the ADSLow Water Level Actuation Timer, or the ADS initiationsignal is present, it is individually sealed in untilmanually reset.

Manual inhibit switches are provided in the control room forthe ADS; however, their function is not required for ADSOPERABILITY (provided ADS is not inhibited when required tobe OPERABLE).

(continued)



BASES

BACKGROUND Diesel Generators(continued) The OGs may be initiated by automatic means. Automaticinitiation occurs for conditions of Reactor Vessel WaterLevel -Low Low Low (Level 1) or Drywell Pressure -High. TheDGs are also initiated upon loss of voltage signals. (Referto the Bases for LCO 3.3.8.1, "Loss of Power (LOP)Instrumentation," for a discussion of these signals.) Thereactor vessel water level variable is monitored by fourredundant transmitters, which are, in turn, connected tofour pressure compensation instruments. The drywellpressure variable is monitored by four redundanttransmitters, which are, in turn, connected to four tripunits. The outputs of the four pressure compensationinstruments and the trip units are connected to relays whichsend signals to two trip systems, with each trip systemarranged in a one-out-of-two taken twice logic (each tripunit sends a signal to both trip systems). The A tripsystem initiates all four DGs and the B trip systeminitiates all four DGs. The DGs receive their initiationsignals from the CS System initiation logic. The DGs canalso be started manually from the control room and locallyfrom the associated DG room. Upon receipt of a loss ofcoolant accident (LOCA) initiation signal, each DG isautomatically started, is ready to load in approximately10 seconds, and will run in standby conditions (ratedvoltage and speed, with the DG output breaker open). TheDGs will only energize their respective Engineered SafetyFeature buses if a loss of offsite power occurs. (Refer toBases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safetySAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiatedLCO, and to preserve the integrity of the fuel cladding by limitingAPPLICABILITY the post LOCA peak cladding temperature to less than the

10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC PolicyStatement. Certain instrumentation Functions are retainedfor other reasons and are described below in the individualFunctions discussion.

The OPERABILITY of the ECCS instrumentation is dependentupon the OPERABILITY of the individual instrumentationchannel Functions specified in Table 3.3.5.1-1. EachFunction must have a required number of OPERABLE channels,

(continued)

I PBAPS UNIT 2 B 3.3-98 Revision No. 21


BASES

APPLICABLE with their setpoints within the specified Allowable Values,SAFETY ANALYSES, where appropriate. The actual setpoint is calibratedLCO, and consistent with applicable setpoint methodology assumptions.APPLICABILITY Table 3.3.5.1-1 is modified by two footnotes. Footnote (a)(continued) is added to clarify that the associated functions are

required to be OPERABLE in MODES 4 and 5 only when theirsupported ECCS are required to be operable per LCO 3.5.2,ECCS-Shutdown. Footnote (b) is added to show that certainECCS instrumentation Functions also perform DG initiation.

Allowable Values are specified for each ECCS Functionspecified in the Table. Trip setpoints are specified inthe setpoint calculations. The trip setpoints are selectedto ensure that the settings do not exceed the AllowableValue between CHANNEL CALIBRATIONS. Operation with a tripsetting less conservative than the trip setpoint, but withinits Allowable Value, is acceptable. A channel is inoperableif its actual trip setpoint is not within its requiredAllowable Value. Trip setpoints are those predeterminedvalues of output at which an action should take place. Thesetpoints are compared to the actual process parameter(e.g., reactor vessel water level), and when the measuredoutput value of the process parameter exceeds the setpoint,the associated device (e.g., trip unit) changes state. Theanalytic or design limits are derived from the limitingvalues of the process parameters obtained from the safetyanalysis or other appropriate documents. The AllowableValues are derived from the analytic or design limits,corrected for calibration, process, and instrument errors.The trip setpoints are determined from analytical or designlimits, corrected for calibration, process, and instrumenterrors, as well as, instrument drift. In selected cases,the Allowable Values and trip setpoints are determined fromengineering judgement or historically accepted practicerelative to the intended functions of the channel. The tripsetpoints determined in this manner provide adequateprotection by assuming instrument and process uncertaintiesexpected for the environments during the operating time ofthe associated channels are accounted for. For the CoreSpray and LPCI Pump Start-Time Delay Relays, adequatemargins for applicable setpoint methodologies areincorporated into the Allowable Values and actual setpoints.

In general, the individual Functions are required to beOPERABLE in the MODES or other specified conditions that mayrequire ECCS. (or DG) initiation to mitigate the consequencesof a design basis transient or accident. To ensure reliableECCS and DG function, a combination of Functions is requiredto provide primary and secondary initiation signals.

(continued)



BASES

APPLICABLE The specific Applicable Safety Analyses, LCO, andSAFETY ANALYSES, Applicability discussions are listed below on a Function byLCO, and Function basis.APPLICABILITY

(continued)Core Spray and Low Pressure Coolant Iniection Systems

1.a, 2.a. Reactor Vessel Water Level-Low Low Low (Level 1)

Low reactor pressure vessel (RPV) water level indicates thatthe capability to cool the fuel may be threatened. ShouldRPV water level decrease too far, fuel damage could result.The low pressure ECCS and associated DGs are initiated atReactor Vessel Water Level-Low Low Low (Level 1) to ensurethat core spray and flooding functions are available toprevent or minimize fuel damage. The DGs are initiated fromFunction l.a signals. This Function, in conjunction with aReactor Pressure-Low (Injection Permissive) signal, alsoinitiates the closure of the Recirculation Discharge Valvesto ensure the LPCI subsystems' inject into the proper RPVlocation. The Reactor Vessel Water Level-Low Low Low(Level 1) is one of the Functions assumed to be OPERABLE andcapable of initiating the ECCS during the transientsanalyzed in References 1 and 3. In addition, the ReactorVessel Water Level-Low Low Low (Level 1) Function isdirectly assumed in the analysis of the recirculation linebreak (Ref. 4) and the control rod drop accident (CRDA)analysis. The core cooling function of the ECCS, along withthe scram action of the Reactor Protection System (RPS),ensures that the fuel peak cladding temperature remainsbelow the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low Low (Level I) signalsare initiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low Low (Level 1)Allowable Value is chosen to allow time for the low pressurecore flooding systems to activate and provide adequatecooling.

Four channels of Reactor Vessel Water Level-Low Low Low(Level 1) Function are only required to be OPERABLE when theECCS are required to be OPERABLE to ensure that no singleinstrument failure can preclude ECCS

(continued)



BASES

APPLICABLE 1.a. 2.a. Reactor Vessel Water Level-Low Low Low (Level 1)SAFETY ANALYSES, (continued)LCO, andAPPLICABILITY initiation. Per footnote (a) to Table 3.3.5.1-1, this ECCS

function is only required to be OPERABLE in MODES 4 and 5whenever the associated ECCS is required to be OPERABLE perLCO 3.5.2. Refer to LCO 3.5.1 and LCO 3.5.2, "ECCS-Shutdown," for Applicability Bases for the low pressure ECCSsubsystems; LCO 3.8.1, "AC Sources-Operating"; andLCO 3.8.2, "AC Sources-Shutdown," for Applicability Basesfor the DGs.

l.b, 2.b. Drywell Pressure-High

High pressure in the drywell could indicate a break in thereactor coolant pressure boundary (RCPB). The low pressureECCS and associated DGs are initiated upon receipt of theDrywell Pressure-High Function with a Reactor Pressure-Low(Injection Permissive) in order to minimize the possibilityof fuel damage. The DGs are initiated from Function 1.bsignals. This Function also initiates the closure of therecirculation discharge valves to ensure the LPCI subsystemsinject into the proper RPV location. The DrywellPressure-High Function with a Reactor Pressure-Low(Injection Permissive), along with the Reactor WaterLevel-Low Low Low (Level 1) Function, is directly assumedin the analysis of the recirculation line break (Ref. 4).The core cooling function of the ECCS, along with the scramaction of the RPS, ensures that the fuel peak claddingtemperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from fourpressure transmitters that sense drywell pressure. TheAllowable Value was selected to be as low as possible and beindicative of a LOCA inside primary containment.

The Drywell Pressure-High Function is required to beOPERABLE when the ECCS or DG is required to be OPERABLE inconjunction with times when the primary containment isrequired to be OPERABLE. Thus, four channels of the CS andLPCI Drywell Pressure-High Function are required to beOPERABLE in MODES 1, 2, and 3 to ensure that no singleinstrument failure can preclude ECCS and DG initiation. InMODES 4 and 5, the Drywell Pressure-High Function is notrequired, since there is insufficient energy in the reactorto pressurize the primary containment to Drywell Pressure-High setpoint. Refer to LCO 3.5.1 for Applicability Basesfor the low pressure ECCS subsystems and to LCO 3.8.1 forApplicability Bases for the DGs.

(continued)



BASES


(continued)

1.c, 2.c. Reactor Pressure-Low (Injection Permissive)

Low reactor pressure signals are used as permissives for thelow pressure ECCS subsystems. This ensures that, prior toopening the injection valves of the low pressure ECCSsubsystems or initiating the low pressure ECCS subsystems ona Drywell Pressure-High signal, the reactor pressure hasfallen to a value below these subsystems' maximum designpressure and a break inside the RCPB has occurredrespectively. This Function also provides permissive forthe closure of the recirculation discharge valves to ensurethe LPCI subsystems inject into the proper RPV location.The Reactor Pressure-Low is one of the Functions assumed tobe OPERABLE and capable of permitting initiation of the ECCSduring the transients analyzed in References 1 and 3. Inaddition, the Reactor Pressure-Low Function is directlyassumed in the analysis of the recirculation line break(Ref. 4). The core cooling function of the ECCS, along withthe scram action of the RPS, ensures that the fuel peakcladding temperature remains below the limits of10 CFR 50.46.

The Reactor Pressure-Low signals are initiated from fourpressure transmitters that sense the reactor dome pressure.

The Allowable Value is low enough to prevent overpressuringthe equipment in the low pressure ECCS, but high enough toensure that the ECCS injection prevents the fuel peakcladding temperature from exceeding the limits of10 CFR 50.46.

Four channels of Reactor Pressure-Low Function are onlyrequired to be OPERABLE when the ECCS is required to beOPERABLE to ensure that no single instrument failure canpreclude ECCS initiation. Per Footnote (a) to Table3.3.5.1-1, this ECCS Function is only required to be OPERABLEin MODES 4 and 5 whenever the associated ECCS is required tobe OPERABLE per LCO 3.5.2. Refer to LCO 3.5.1 and LCO 3.5.2for Applicability Bases for the low pressure ECCSsubsystems.

l.d, 2.q. Core Spray and Low Pressure Coolant InjectionPump Discharge Flow-Low (Bypass)

The minimum flow instruments are provided to protect theassociated low pressure ECCS pump from overheating when thepump is operating and the associated injection valve is notfully open. The minimum flow line valve is opened when lowflow is sensed, and the valve is automatically closed whenthe flow rate is adequate to protect the pump. The LPCI and

(continued)



BASES

APPLICABLE 1.d, 2.q. Core Spray and Low Pressure Coolant InjectionSAFETY ANALYSES, Pump Discharge Flow-Low (Bypass) (continued)LCO, andAPPLICABILITY CS Pump Discharge Flow-Low Functions are assumed to be

OPERABLE and capable of closing the minimum flow valves toensure that the low pressure ECCS flows assumed during thetransients and accidents analyzed in References 1, 2, and 3are met. The core cooling function of the ECCS, along withthe scram action of the RPS, ensures that the fuel peakcladding temperature remains below the limits of10 CFR 50.46.

One differential pressure switch per ECCS pump is used todetect the associated subsystems' flow rates. The logic isarranged such that each switch causes its associated minimumflow valve to open. The logic will close the minimum flowvalve once the closure setpoint is exceeded. The LPCIminimum flow valves are time delayed such that the valveswill not open for 10 seconds after the switches detect lowflow. The time delay is provided to limit reactor vesselinventory loss during the startup of the RHR shutdowncooling mode. The Pump Discharge Flow-Low Allowable Valuesare high enough to ensure that the pump flow rate issufficient to protect the pump, yet low enough to ensurethat the closure of the minimum flow valve is initiated toallow full flow into the core.

Each channel of Pump Discharge Flow-Low Function (four CSchannels and four LPCI channels) is only required to beOPERABLE when the associated ECCS is required to be OPERABLEto ensure that no single instrument failure can preclude theECCS function. Per footnote (a) to Table 3.3.5.1-1, thisECCS Function is only required to be OPERABLE in MODES 4 and5 whenever the associated ECCS is required to be OPERABLEper LCO 3.5.2. Refer to LCO 3.5.1 and LCO 3.5.2 forApplicability Bases for the low pressure ECCS subsystems.

I.e. 1.f. Core Spray Pump Start-Time Delay Relay

The purpose of this time delay is to stagger the start ofthe CS pumps that are in each of Divisions I and 11 toprevent overloading the power source. This Function isnecessary when power is being supplied from the offsitesources or the standby power sources (DG). The CS PumpStart-Time Delay Relays are assumed to be OPERABLE in theaccident and transient analyses requiring ECCS initiation.That is, the analyses assume that the pumps will initiatewhen required and excess loading will not cause failure ofthe power sources.

(continued) k



BASES


I.e, 1.f.(continued)

Core Sprav PumD Start-Time Delay Relay

There are eight Core Spray Pump Start-Time Delay Relays,two in each of the CS pump start logic circuits (one forwhen offsite power is available and one for when offsitepower is not available). One of each type of time delayrelay is.dedicated to a single pump start logic, such that asingle failure of a Core Spray Pump Start-Time Delay Relaywill not result in the failure of more than one CS pump. Inthis condition, three of the four CS pumps will remainOPERABLE; thus, the single failure criterion is met (i.e.,loss of one instrument does not preclude ECCS initiation).The Allowable Value for the Core Spray Pump Start-TimeDelay Relays is chosen to be long enough so that the powersource will not be overloaded and short enough so that ECCSoperation is not degraded.

Each channel of Core Spray Pump Start-Time Delay RelayFunction is required to be OPERABLE only when the associatedCS subsystem is required to be OPERABLE. Per footnote (a)to Table 3.3.5.1-1, this ECCS Function is only required tobe OPERABLE in MODES 4 and 5 whenever the associated ECCS isrequired to be OPERABLE per LCO 3.5.2. Refer to LCO 3.5.1and LCO 3.5.2 for Applicability Bases for the CS subsystems.

2.d. Reactor Pressure-Low Low (Recirculation DischargeValve Permissive)

Low reactor pressure signals are used as permissives forrecirculation discharge valve closure. This ensures thatthe LPCI subsystems inject into the proper RPV locationassumed in the safety analysis. The Reactor Pressure-LowLow is one of the Functions assumed to be OPERABLE andcapable of closing the valve during the transients analyzedin References 1 and 3. The core cooling function of theECCS, along with the scram action of the RPS, ensures thatthe fuel peak cladding temperature remains below the limitsof 10 CFR 50.46. The Reactor Pressure-Low Low Function isdirectly assumed in the analysis of the recirculation linebreak (Ref. 4).

The Reactor Pressure-Low Low signals are initiated fromfour pressure transmitters that sense the reactor pressure.

The Allowable Value is chosen to ensure that the valvesclose prior to commencement of LPCI injection flow into thecore, as assumed in the safety analysis.

(continued)



BASES


2.d. Reactor Pressure-Low Low (Recirculation DischargeValve Permissive) (continued)

Four channels of the Reactor Pressure-Low Low Function areonly required to be OPERABLE in MODES 1, 2, and 3 with theassociated recirculation pump discharge valve open. Withthe valve(s) closed, the function of the instrumentation hasbeen performed; thus, the Function is not required. InMODES 4 and 5, the loop injection location is not criticalsince LPCI injection through the recirculation loop ineither direction will still ensure that LPCI flow reachesthe core (i.e., there is no significant reactor backpressure).

2.e. Reactor Vessel Shroud Level--Level 0

The Reactor Vessel Shroud Level-Level 0 Function isprovided as a permissive to allow the RHR System to bemanually aligned from the LPCI mode to the suppression poolcooling/spray or drywell spray modes. The reactor vesselshroud level permissive ensures that water in the vessel isapproximately two thirds core height before the manualtransfer is allowed. This ensures that LPCI is available toprevent or minimize fuel damage. This function may beoverridden during accident conditions as allowed by plantprocedures. Reactor Vessel Shroud Level--Level 0 Functionis implicitly assumed in the analysis of the recirculationline break (Ref. 4) since the analysis assumes that no LPCIflow diversion occurs when reactor water level is belowLevel 0.

Reactor Vessel Shroud Level-Level 0 signals are initiatedfrom two level transmitters that sense the differencebetween the pressure due to a constant column of water(reference leg) and the pressure due to the actual waterlevel (variable leg) in the vessel. The Reactor VesselShroud Level--Level 0 Allowable Value is chosen to allow thelow pressure core flooding systems to activate and provideadequate cooling before allowing a manual transfer.

(continued)



BASES

APPLICABLE 2.e. Reactor Vessel Shroud Level-Level 0 (continued)SAFETY ANALYSES,LCO, and Two channels of the Reactor Vessel Shroud Level-Level 0APPLICABILITY Function are only required to be OPERABLE in MODES 1, 2,

and 3. In MODES 4 and 5, the specified initiation time ofthe LPCI subsystems is not assumed, and other administrativecontrols are adequate to control the valves associated withthis Function (since the systems that the valves are openedfor are not required to be OPERABLE in MODES 4 and 5 and arenormally not used).

2.f. Low Pressure Coolant Injection Pump Start-Time DelayRelay

The purpose of this time delay is to stagger the start ofthe LPCI pumps that are in each of Divisions I and II, toprevent overloading the power source. This Function is onlynecessary when power is being supplied from offsite sources.The LPCI pumps start simultaneously with no time delay assoon as the standby source is available. The LPCI PumpStart-Time Delay Relays are assumed to be OPERABLE in theaccident and transient analyses requiring ECCS initiation.That is, the analyses assume that the pumps will initiatewhen required and excess loading will not cause failure ofthe power sources.

There are eight LPCI Pump Start-Time Delay Relays, two ineach of the RHR pump start logic circuits. Two time delayrelays are dedicated to a single pump start logic. Bothtimers in the RHR pump start logic would have to fail toprevent an RHR pump from starting within the required time;therefore, the low pressure ECCS pumps will remain OPERABLE;thus, the single failure criterion is met (i.e., loss of oneinstrument does not preclude ECCS initiation). TheAllowable Values for the LPCI Pump Start-Time Delay Relaysare chosen to be long enough so that most of the startingtransient of the first pump is complete before starting thesecond pump on the same 4 kV emergency bus and short enoughso that ECCS operation is not degraded.

Each channel of LPCI Pump Start-Time Delay Relay Functionis required to be OPERABLE only when the associated LPCIsubsystem is required to be OPERABLE. Per footnote (a) toTable 3.3.5.1-1, this ECCS Function is only required to beOPERABLE in MODES 4 and 5 whenever the associated ECCS isrequired to be OPERABLE per LCO 3.5.2. Refer to LCO 3.5.1and LCO 3.5.2 for Applicability Bases for the LPCIsubsystems.

(continued)



BASES


(continued)

Hich Pressure Coolant Injection (HPCI) System

3.a. Reactor Vessel Water Level-Low Low (Level 2)

Low RPV water level indicates that the capability to coolthe fuel may be threatened. Should RPV water level decreasetoo far, fuel damage could result. Therefore, the HPCISystem is initiated at Level 2 to maintain level above thetop of the active fuel. The Reactor Vessel Water Level--LowLow (Level 2) is one of the Functions assumed to be OPERABLEand capable of initiating HPCI during the transientsanalyzed in References 1 and 3. Additionally, the ReactorVessel Water Level--Low Low (Level 2) Function associatedwith HPCI is credited as a backup to the DrywellPressure-High Function for initiating HPCI in the analysisof the recirculation line break. The core cooling functionof the ECCS, along with the scram action of the RPS, ensuresthat the fuel peak cladding temperature remains below thelimits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low (Level 2) signals areinitiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low (Level 2) AllowableValue is high enough such that for complete loss offeedwater flow, the Reactor Core Isolation Cooling (RCIC)System flow with HPCI assumed to fail will be sufficient toavoid initiation of low pressure ECCS at Reactor VesselWater Level--Low Low Low (Level 1).

Four channels of Reactor Vessel Water Level--Low Low(Level 2) Function are required to be OPERABLE only whenHPCI is required to be OPERABLE to ensure that no singleinstrument failure can preclude HPCI initiation. Refer toLCO 3.5.1 for HPCI Applicability Bases.

3.b. Drywell Pressure-High

High pressure in the drywell could indicate a break in theRCPB. The HPCI System is initiated upon receipt of theDrywell Pressure-High Function in order to minimize thepossibility of fuel damage. The Drywell Pressure-HighFunction is directly assumed in the analysis of the

(continued)



BASES

APPLICABLE 3.b. Drywell Pressure-High (continued)SAFETY ANALYSES,LCO, and recirculation line break (Ref. 4). The core coolingAPPLICABILITY function of the ECCS, along with the scram action of the

RPS, ensures that the fuel peak cladding temperature remainsbelow the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from fourpressure transmitters that sense drywell pressure. TheAllowable Value was selected to be as low as possible to beindicative of a LOCA inside primary containment.

Four channels of the Drywell Pressure-High Function arerequired to be OPERABLE when HPCI is required to be OPERABLEto ensure that no single instrument failure can precludeHPCI initiation. Refer to LCO 3.5.1 for the ApplicabilityBases for the HPCI System.

3.c. Reactor Vessel Water Level-High (Level 8)

High RPV water level indicates that sufficient cooling waterinventory exists in the reactor vessel such that there is nodanger to the fuel. Therefore, the Level 8 signal is usedto trip the HPCI turbine to prevent overflow into the mainsteam lines (MSLs). The Reactor Vessel Water Level--High(Level 8) Function is assumed to trip the HPCI turbine inthe feedwater controller failure transient analysis if HPCIis initiated.

Reactor Vessel Water Level-High (Level 8) signals for HPCIare initiated from two level transmitters from the widerange water level measurement instrumentation. Both Level 8signals are required in order to trip the HPCI turbine.This ensures that no single instrument failure can precludeHPCI initiation. The Reactor Vessel Water Level--High(Level 8) Allowable Value is chosen to prevent flow from theHPCI System from overflowing into the MSLs.

Two channels of Reactor Vessel Water Level--High (Level 8)Function are required to be OPERABLE only when HPCI isrequired to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2for HPCI Applicability Bases.

(continued)



BASES


(continued)

3.d. Condensate Storaqe Tank Level-Low

Low level in the CST indicates the unavailability of anadequate supply of makeup water from this normal source.Normally the suction valves between HPCI and the CST areopen and, upon receiving a HPCI initiation signal, water forHPCI injection would be taken from the CST. However, if thewater level in the CST falls below a preselected level,first the suppression pool suction valves automaticallyopen, and then the CST suction valve automatically closes.This ensures that an adequate supply of makeup water isavailable to the HPCI pump. To prevent losing suction tothe pump, the suction valves are interlocked so that thesuppression pool suction valves must be open before the CSTsuction valve automatically closes. The Function isimplicitly assumed in the accident and transient analyses(which take credit for HPCI) since the analyses assume thatthe HPCI suction source is the suppression pool.

Condensate Storage Tank Level--Low signals are initiatedfrom two level switches. The logic is arranged such thateither level switch can cause the suppression pool suctionvalves to open and the CST suction valve to close. TheCondensate Storage Tank Level-Low Function Allowable Valueis high enough to ensure adequate pump suction head whilewater is being taken from the CST.

Two channels of the Condensate Storage Tank Level--LowFunction are required to be OPERABLE only when HPCI isrequired to be OPERABLE to ensure that no single instrumentfailure can preclude HPCI swap to suppression pool source.Refer to LCO 3.5.1 for HPCI Applicability Bases.

3.e. SuDpression Pool Water Level -HiQh

9

Excessively high suppression pool water could result in theloads on the suppression pool exceeding design values shouldthere be a blowdown of the reactor vessel pressure throughthe safety/relief valves. Therefore, signals indicatinghigh suppression pool water level are used to transfer thesuction source of HPCI from the CST to the suppression poolto eliminate the possibility of HPCI continuing to provideadditional water from a source outside containment. Toprevent losing suction to the pump, the suction valves areinterlocked so that the suppression pool suction valves mustbe open before the CST suction valve automatically closes.

(continued)



BASES

APPLICABLE 3.e. Suppression Pool Water Level-Hiqhb (continued)SAFETY ANALYSES,LCO, and This Function is implicitly assumed in the accident andAPPLICABILITY transient analyses (which take credit for HPCI) since the

analyses assume that the HPCI suction source is thesuppression pool.

Suppression Pool Water Level-High signals are initiatedfrom two level switches. The logic is arranged such thateither switch can cause the suppression pool suction valvesto open and the CST suction valve to close. The AllowableValue for the Suppression Pool Water Level--High Function ischosen to ensure that HPCI will be aligned for suction fromthe suppression pool to prevent HPCI from contributing toany further increase in the suppression pool level.

Two channels of Suppression Pool Water Level--High Functionare required to be OPERABLE only when HPCI is required to beOPERABLE to ensure that no single instrument failure canpreclude HPCI swap to suppression pool source. Refer toLCO 3.5.1 for HPCI Applicability Bases.

3.f. High Pressure Coolant Injection Pump DischargeFlow-Low (Bypass)

The minimum flow instrument is provided to protect the HPCIpump from overheating when the pump is operating at reducedflow. The minimum flow line valve is opened when low flowis sensed, and the valve is automatically closed when theflow rate is adequate to protect the pump. The HighPressure Coolant Injection Pump Discharge Flow-Low Functionis assumed to be OPERABLE and capable of closing the minimumflow valve to ensure that the ECCS flow assumed during thetransients analyzed in Reference 4 is met. The core coolingfunction of the ECCS, along with the scram action of theRPS, ensures that the fuel peak cladding temperature remainsbelow the limits of 10 CFR 50.46.

One flow switch is used to detect the HPCI System's flowrate. The logic is arranged such that the transmittercauses the minimum flow valve to open. The logic will closethe minimum flow valve once the closure setpoint isexceeded.

(continued)



BASES

APPLICABLE 3.f. High Pressure Coolant Injection Pump DischargeSAFETY ANALYSES, Flow-Low (Bypass) (continued)LCO, andAPPLICABILITY The High Pressure Coolant Injection Pump Discharge Flow-Low

Allowable Value is high enough to ensure that pump flow rateis sufficient to protect the pump, yet low enough to ensurethat the closure of the minimum flow valve is initiated toallow full flow into the core.

One channel is required to be OPERABLE when the HPCI isrequired to be OPERABLE. Refer to LCO 3.5.1 for HPCIApplicability Bases.

Automatic Depressurization System

4.a. 5.a. Reactor Vessel Water Level-Low Low Low (Level 1)

Low RPV water level indicates that the capability to coolthe fuel may be threatened. Should RPV water level decreasetoo far, fuel damage could result. Therefore, ADS receivesone of the signals necessary for initiation from thisFunction. The Reactor Vessel Water Level--Low Low Low(Level 1) is one of the Functions assumed to be OPERABLE andcapable of initiating the ADS during the accident analyzedin Reference 4. The core cooling function of the ECCS,along with the scram action of the RPS, ensures that thefuel peak cladding temperature remains below the limits of10 CFR 50.46.

Reactor Vessel Water Level-Low Low Low (Level 1) signalsare initiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level. (variable leg) in the vessel. Four channels ofReactor Vessel Water Level-Low Low Low (Level 1) Functionare required to be OPERABLE only when ADS is required to beOPERABLE to ensure that no single instrument failure canpreclude ADS initiation. Two channels input to ADS tripsystem A, while the other two channels input to ADS tripsystem B. Refer to LCO 3.5.1 for ADS Applicability Bases.

The Reactor Vessel Water Level-Low Low Low (Level 1)Allowable Value is chosen to allow time for the low pressurecore flooding systems to initiate and provide adequatecooling.

(continued)



BASES


(continued)

4.b, 5.b. Drywell Pressure-High

High pressure in the drywell could indicate a break in theRCPB. Therefore, ADS receives one of the signals necessaryfor initiation from this Function in order to minimize thepossibility of fuel damage. The Drywell Pressure-High isassumed to be OPERABLE and capable of initiating the ADSduring the accidents analyzed in Reference 4. The corecooling function of the ECCS, along with the scram action ofthe RPS, ensures that the fuel peak cladding temperatureremains below the limits of 10 CFR 50.46.

Drywell Pressure-High signals are initiated from fourpressure transmitters that sense drywell pressure. TheAllowable Value was selected to be as low as possible and beindicative of a LOCA inside primary containment.

Four channels of Drywell Pressure-High Function are onlyrequired to be OPERABLE when ADS is required to be OPERABLEto ensure that no single instrument failure can preclude ADSinitiation. Two channels input to ADS trip system A, whilethe other two channels input to ADS trip system B. Refer toLCO 3.5.1 for ADS Applicability Bases.

4.c. 5.c. Automatic Depressurization System InitiationTimer

The purpose of the Automatic Depressurization SystemInitiation Timer is to delay depressurization of the reactorvessel to allow the HPCI System time to maintain reactorvessel water level. Since the rapid depressurization causedby ADS operation is one of the most severe transients on thereactor vessel, its occurrence should be limited. Bydelaying initiation of the ADS Function, the operator isgiven the chance to monitor the success or failure of theHPCI System to maintain water level, and then to decidewhether or not to allow ADS to initiate, to delay initiationfurther by recycling the timer, or to inhibit initiationpermanently. The Automatic Depressurization SystemInitiation Timer Function is assumed to be OPERABLE for theaccident analysis of Reference 4 that requires ECCSinitiation and assumes failure of the HPCI System.

(continued)



BASES

APPLICABLE 4.c, 5.c. Automatic Depressurization System InitiationSAFETY ANALYSES, Timer (continued)LCO, andAPPLICABILITY There are two Automatic Depressurization System Initiation

Timer relays, one in each of the two ADS trip systems. TheAllowable Value for the Automatic Depressurization SystemInitiation Timer is chosen so that there is still time afterdepressurization for the low pressure ECCS subsystems toprovide adequate core cooling.

Two channels of the Automatic Depressurization SystemInitiation Timer Function are only required to be OPERABLEwhen the ADS is required to be OPERABLE to ensure that nosingle instrument failure can preclude ADS initiation. (Onechannel inputs to ADS trip system A, while the other channelinputs to ADS trip system B. Refer to LCO 3.5.1 for ADSApplicability Bases.

4.d. 5.d. Reactor Vessel Water Level- Low Low Low(Level 1) (Permissive)

Low reactor water level signals are used as permissives inthe ADS trip systems. This ensures after a high drywellpressure signal or a low reactor water level signal(Level 1) is received and the timer times out that a lowreactor water level (Level 1), signal is present to allowthe ADS initiation (after a confirmatory Level 4 signal, seeBases for Functions 4.e, 5.e, Reactor Vessel WaterConfirmatory Level--Low (Level 4).

Reactor Vessel Water Level-Low Low Low (Level 1), signalsare initiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure doe to the actualwater level (variable leg) in the vessel. The ReactorVessel Water Level--Low Low Low (Level 1) Allowable Value ischosen to allow time for the low pressure core floodingsystem to initiate and provide adequate cooling.

Four channels of the Reactor Vessel Water Level--Low Low Low(Level 1) Function are required to be OPERABLE to ensurethat no single instrument failure can preclude ADSinitiation. Two channels input to ADS trip system A whilethe other two channels input to ADS trip system B. Refer toLCO 3.5.1 for ADS Applicability Bases.

(continued)


ECCS Instrumentation

B 3.3.5.1

BASES

APPLICABLE 4.e. 5.e. Reactor Vessel Water Confirmatory Level--LowSAFETY ANALYSES, (Level 4)LCO, andAPPLICABILITY The Reactor Vessel Water Confirmatory Level--Low (Level 4)

(continued) Function is used by the ADS only as a confirmatory low waterlevel signal. ADS receives one of the signals necessary forinitiation from Reactor Vessel Water Level--Low Low Low(Level 1) signals. In order to prevent spurious initiationof -the ADS due to spurious Level I signals, a Level 4 signalmust also be received before ADS initiation commences.

Reactor Vessel Water Confirmatory Level--Low (Level 4)signals are initiated from two level transmitters that sensethe difference between the pressure due to a constant columnof water (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel. The AllowableValue for Reactor Vessel Water Confirmatory Level--Low(Level 4) is selected to be above the RPS Level 3 scramAllowable Value for convenience.

Two channels of Reactor Vessel Water Confirmatory Level-Low(Level 4) Function are only required to be OPERABLE when theADS is required to be OPERABLE to ensure that no singleinstrument failure can preclude ADS initiation. One channelinputs to ADS trip system A, while the other channel inputsto ADS trip system B. Refer to LCO 3.5.1 for ADSApplicability Bases.

4.f, 4.q, 5.f. 5.q. Core Spray and Low Pressure CoolantInjection Pump Discharge Pressure-High

The Pump Discharge Pressure-High signals from the CS andLPCI pumps are used as permissives for ADS initiation,indicating that there is a source of low pressure coolingwater available once the ADS has depressurized the vessel.Pump Discharge Pressure-High is one of the Functionsassumed to be OPERABLE and capable of permitting ADSinitiation during the events analyzed in Reference 4 with anassumed HPCI failure. For these events the ADSdepressurizes the reactor vessel so that the low pressureECCS can perform the core cooling functions. This corecooling function of the ECCS, along with the scram action ofthe RPS, ensures that the fuel peak cladding temperatureremains below the limits of 10 CFR 50.46.

(continued)



BASES


4.f. 4.q, 5.f. 5.q. Core Spray and Low Pressure CoolantInjection Pump Discharge Pressure-High (continued)

Pump discharge pressure signals are initiated from twelvepressure transmitters, two on the discharge side of each ofthe four LPCI pumps and one on the discharge side of each CSpump. There are two ADS low pressure ECCS pump permissivesin each trip system. Each of the permissives receivesinputs from all four LPCI pumps (different signals for eachpermissive) and two CS pumps, one from each subsystem(different pumps for each permissive). In order to generatean ADS permissive in one trip system, it is necessary thatonly one LPCI pump or two CS pumps in proper combination (Cor D and A or B) indicate the high discharge pressurecondition in each of the two permissives. The PumpDischarge Pressure-High Allowable Value is less than thepump discharge pressure when the pump is operating in a fullflow mode and high enough to avoid any condition thatresults in a discharge pressure permissive when the CS andLPCI pumps are aligned for injection and the pumps are notrunning. The actual operating point of this function is notassumed in any transient or accident analysis. However,this Function is indirectly assumed to operate (in Reference4) to provide the ADS permissive to depressurize the RCS toallow the ECCS low pressure systems to operate.

Twelve channels of Core Spray and Low Pressure CoolantInjection Pump Discharge Pressure-High Function are onlyrequired to be OPERABLE when the ADS is required to beOPERABLE to ensure that no single instrument failure canpreclude ADS initiation. Four CS channels associated withCS pumps A through D and eight LPCI channels associated withLPCI pumps A through D are required for both trip systems.Refer to LCO 3.5.1 for ADS Applicability Bases.

4.h. 5.h. Automatic Depressurization System Low Water LevelActuation Timer

One of the signals required for ADS initiation is DrywellPressure-High. However, if the event requiring ADSinitiation occurs outside the drywell (e.g., main steam linebreak outside containment), a high drywell pressure signalmay never be present. Therefore, the AutomaticDepressurization System Low Water Level Actuation Timer isused to bypass the Drywell Pressure-High Function after a

(continued)



BASES

APPLICABLE 4.h. 5.h. Automatic Depressurization System Low Water LevelSAFETY ANALYSES, Actuation Timer (continued)LCO, andAPPLICABILITY certain time period has elapsed. Operation of the Automatic

Depressurization System Low Water Level Actuation TimerFunction is assumed in the accident analysis of Reference 4that requires ECCS initiation and assumes failure of theHPCI system.

There are four Automatic Depressurization System Low WaterLevel Actuation Timer relays, two in each of the two ADStrip systems. The Allowable Value for the AutomaticDepressurization System Low Water Level Actuation Timer ischosen to ensure that there is still time afterdepressurization for the low pressure ECCS subsystems toprovide adequate core cooling.

Four channels of the Automatic Depressurization System LowWater Level Actuation Timer Function are only required to beOPERABLE when the ADS is required to be OPERABLE to ensurethat no single instrument failure can preclude ADSinitiation. Refer to LCO 3.5.1 for ADS Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related toECCS instrumentation channels. Section 1.3, CompletionTimes, specifies that once a Condition has been entered,subsequent divisions, subsystems, components, or variablesexpressed in the Condition discovered to be inoperable ornot within limits will not result in separate entry into theCondition. Section 1.3 also specifies that Required Actionsof the Condition continue to apply for each additionalfailure, with Completion Times based on initial entry intothe Condition. However, the Required Actions for inoperableECCS instrumentation channels provide appropriatecompensatory measures for separate inoperable Conditionentry for each inoperable ECCS instrumentation channel.

A.1

Required Action A.1 directs entry into the appropriateCondition referenced in Table 3.3.5.1-1. The applicableCondition referenced in the table is Function dependent.Each time a channel is discovered inoperable, Condition A isentered for that channel and provides for transfer to theappropriate subsequent Condition.

(continued)



BASES

ACTIONS B.1, B.2, and B.3(continued)

Required Actions B.1 and B.2 are intended to ensure thatappropriate actions are taken if multiple, inoperable,untripped channels within the same Function result inredundant automatic initiation capability being lost for thefeature(s). Required Action B.I features would be thosethat are initiated by Functions ].a, 1.b, 2.a, and 2.b(e.g., low pressure ECCS). The Required Action B.2 systemwould be HPCI. For Required Action B.1, redundant automaticinitiation capability is lost if (a) two or moreFunction l.a channels are inoperable and untripped such thatboth trip systems lose initiation capability, (b) two ormore Function 2.a channels are inoperable and untripped suchthat both trip systems lose initiation capability, (c) twoor more Function 1.b channels are inoperable and untrippedsuch that both trip systems lose initiation capability, or(d) two or more Function 2.b channels are inoperable anduntripped such that both trip systems lose initiationcapability. For low pressure ECCS, since each inoperablechannel would have Required Action B.1 applied separately(refer to ACTIONS Note), each inoperable channel would onlyrequire the affected portion of the associated system of lowpressure ECCS and DGs to be declared inoperable. However,since channels in both associated low pressure ECCSsubsystems (e.g., both CS subsystems) are inoperable anduntripped, and the Completion Times started concurrently forthe channels in both subsystems, this results in theaffected portions in the associated low pressure ECCS andDGs being concurrently declared inoperable.

For Required Action B.2, redundant automatic HPCI initiationcapability is lost if two or more Function 3.a or twoFunction 3.b channels are inoperable and untripped such thatthe trip system loses initiation capability. In thissituation (loss of redundant automatic initiationcapability), the 24 hour allowance of Required Action B.3 isnot appropriate and the HPCI System must be declaredinoperable within 1 hour. As noted (Note 1 to RequiredAction B.1), Required Action B.1 is only applicable inMODES 1, 2, and 3. In MODES 4 and 5, the specificinitiation time of the low pressure ECCS is not assumed andthe probability of a LOCA is lower. Thus, a total loss of

(continued)



BASES

ACTIONS B.], B.2, and B.3 (continued)

initiation capability for 24 hours (as allowed by RequiredAction B.3) is allowed during MODES 4 and 5. There is nosimilar Note provided for Required Action B.2 since HPCIinstrumentation is not required in MODES 4 and 5; thus, aNote is not necessary.

Notes are also provided (Note 2 to Required Action B.1 andthe Note to Required Action B.2) to delineate which RequiredAction is applicable for each Function that requires entryinto Condition B if an associated channel is inoperable.This ensures that the proper loss of initiation capabilitycheck is performed. Required Action B.1 (the RequiredAction for certain inoperable channels in the low pressureECCS subsystems) is not applicable to Function 2.e, sincethis Function provides backup to administrative controlsensuring that operators do not divert LPCI flow frominjecting into the core when needed. Thus, a total loss ofFunction 2.e capability for 24 hours is allowed, since theLPCI subsystems remain capable of performing their intendedfunction.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."For Required Action B.1, the Completion Time only beginsupon discovery that a redundant feature in the same system(e.g., both CS subsystems) cannot be automatically initiateddue to inoperable, untripped channels within the sameFunction as described in the paragraph above. For RequiredAction B.2, the Completion Time only begins upon discoverythat the HPCI System cannot be automatically initiated dueto two inoperable, untripped channels for the associatedFunction in the same trip system. The 1 hour CompletionTime from discovery of loss of initiation capability isacceptable because it minimizes risk while allowing time forrestoration or tripping of channels.

Because of the diversity of sensors available to provideinitiation signals and the redundancy of the ECCS design, anallowable out of service time of 24 hours has been shown tobe acceptable (Ref. 5) to permit restoration of anyinoperable channel to OPERABLE status. If the inoperablechannel cannot be restored to OPERABLE status within the

(continued)



BASES

ACTIONS B.1, B.2, and B.3 (continued)

allowable out of service time, the channel must be placed inthe tripped condition per Required Action B.3. Placing theinoperable channel in trip would conservatively compensatefor the inoperability, restore capability to accommodate asingle failure, and allow operation to continue.Alternately, if it is not desired to place the channel intrip (e.g., as in the case where placing the inoperablechannel in trip would result in an initiation), Condition Hmust be entered and its Required Action taken.

C.1 and C.2

Required Action C.1 is intended to ensure that appropriateactions are taken if multiple, inoperable channels withinthe same Function result in redundant automatic initiationcapability being lost for the feature(s). RequiredAction C.1 features would be those that are initiated byFunctions l.c, I.e, ].f, 2.c, 2.d, and 2.f (i.e., lowpressure ECCS). Redundant automatic initiation capabilityis lost if either (a) two or more Function 1.c channels areinoperable in the same trip system such that the trip systemloses initiation capability, (b) two or more Function I.echannels are inoperable affecting CS pumps in differentsubsystems, (c) two or more Function 1.f channels areinoperable affecting CS pumps in different subsystems, (d)two or more Function 2.c channels are inoperable in the sametrip system such that the trip system loses initiationcapability, (e) two or more Function 2.d channels areinoperable in the same trip system such that the trip systemloses initiation capability, or (f) three or moreFunction 2.f channels are inoperable. In this situation(loss of redundant automatic initiation capability), the24 hour allowance of Required Action C.2 is not appropriateand the feature(s) associated with the inoperable channelsmust be declared inoperable within I hour. Since eachinoperable channel would have Required Action C.1 appliedseparately (refer to ACTIONS Note), each inoperable channelwould only require the affected portion of the associatedsystem to be declared inoperable. However, since channelsfor both low pressure ECCS subsystems are inoperable (e.g.,both CS subsystems), and the Completion Times startedconcurrently for the channels in both subsystems, thisresults in the affected portions in both subsystems being

(continued)



BASES


concurrently declared inoperable. For Functions 1.c, 1.e,I.f, 2.c, 2.d, and 2.f, the affected portions are theassociated low pressure ECCS pumps. As noted (Note 1),Required Action C.1 is only applicable in MODES 1, 2, and 3.In MODES 4 and 5, the specific initiation time of the ECCSis not assumed and the probability of a LOCA is lower.Thus, a total loss of automatic initiation capability for24 hours (as allowed by Required Action C.2) is allowedduring MODES 4 and 5.

Note 2 states that Required Action C.1 is only applicablefor Functions I.c, 1.e, ].f, 2.c, 2.d, and 2.f. RequiredAction C.1 is not applicable to Function 3.c (which alsorequires entry into this Condition if a channel in thisFunction is inoperable), since the loss of one channelresults in a loss of the Function (two-out-of-two logic).This loss was considered during the development ofReference 5 and considered acceptable for the 24 hoursallowed by Required Action C.2.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."For Required Action C.1, theCompletion Time only beginsupon discovery that the same feature in both subsystems(e.g., both CS subsystems) cannot be automatically initiateddue to inoperable channels within the same Function asdescribed in the paragraph above. The 1 hour CompletionTime from discovery of loss of initiation capability isacceptable because it minimizes risk while allowing time forrestoration of channels.

Because of the diversity of sensors available to provideinitiation signals and the redundancy of the ECCS design, anallowable out of service time of 24 hours has been shown tobe acceptable (Ref. 5) to permit restoration of anyinoperable channel to OPERABLE status. If the inoperablechannel cannot be restored to OPERABLE status within theallowable out of service time, Condition H must be enteredand its Required Action taken. The Required Actions do notallow placing the channel in trip since this action wouldeither cause. the initiation or it would not necessarilyresult in a safe state for the channel in all events.

(continued)



BASES

ACTIONS D.I. D.2.1, and D.2.2(continued)

Required Action D.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in a complete lossof automatic component initiation capability for the HPCISystem. Automatic component initiation capability is lostif two Function 3.d channels or two Function 3.e channelsare inoperable and untripped. In this situation (loss ofautomatic suction swap), the 24 hour allowance of RequiredActions D.2.1 and D.2.2 is not appropriate and the HPCISystem must be declared inoperable within I hour afterdiscovery of loss of HPCI initiation capability. As noted,Required Action D.1 is only applicable if the HPCI pumpsuction is not aligned to the suppression pool, since, ifaligned, the Function is already performed.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."For Required Action D.1, the Completion Time only beginsupon discovery that the HPCI System cannot be automaticallyaligned to the suppression pool due to two inoperable,untripped channels in the same Function. The 1 hourCompletion Time from discovery of loss of initiationcapability is acceptable because it minimizes risk whileallowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provideinitiation signals and the redundancy of the ECCS design, anallowable out of service time of 24 hours has been shown tobe acceptable (Ref. 5) to permit restoration of anyinoperable channel to OPERABLE status. If the inoperablechannel cannot be restored to OPERABLE status within theallowable out of service time, the channel must be placed inthe tripped condition per Required Action D.2.1 or thesuction source must be aligned to the suppression pool perRequired Action D.2.2. Placing the inoperable channel intrip performs the intended function of the channel (shiftingthe'suction source to the suppression pool). Performance ofeither of these two Required Actions will allow operation tocontinue. If Required Action D.2.1 or D.2.2 is performed,measures should be taken to ensure that the HPCI System

(continued)



BASES

ACTIONS D.I. D.2.1, and D.2.2 (continued)

piping remains filled with water. Alternately, if it is notdesired to perform Required Actions D.2.1 and D.2.2 (e.g.,as in the case where shifting the suction source could draindown the HPCI suction piping), Condition H must be enteredand its Required Action taken.

E.1 and E.2

Required Action E.1 is intended to ensure that appropriateactions are taken if multiple, inoperable channels withinthe Core Spray and Low Pressure Coolant Injection Pump,Discharge Flow - Low (Bypass) Functions result in redundantautomatic initiation capability being lost for thefeature(s). For Required Action E.1, the features would bethose that are initiated by Functions 1.d and 2.g (e.g., lowpressure ECCS). Redundant automatic initiation capabilityis lost if (a) two or more Function 1.d channels areinoperable affecting CS pumps in different subsystems or(b) three or more Function 2.g channels are inoperable.Since each inoperable channel would have Required Action E.1applied separately (refer to ACTIONS Note), each inoperablechannel would only require the affected low pressure ECCSpump to be declared inoperable. However, since channels formore than one low pressure ECCS pump are inoperable, and theCompletion Times started concurrently for the channels ofthe low pressure ECCS pumps, this results in the affectedlow pressure ECCS pumps being concurrently declaredinoperable.

In this situation (loss of redundant automatic initiationcapability), the 7 day allowance of Required Action E.2 isnot appropriate and the subsystem associated with eachinoperable channel must be declared inoperable withinI hour. As noted (Note I to Required Action E.1), RequiredAction E.1 is only applicable in MODES 1, 2, and 3. InMODES 4 and 5, the specific initiation time of the ECCS isnot assumed and the probability of a LOCA is lower. Thus, atotal loss of initiation capability for 7 days (as allowedby Required Action E.2) is allowed during MODES 4 and 5. ANote is also provided (Note 2 to Required Action E.I) todelineate that Required Action E.1 is only applicable to low

(continued)



BASES


pressure ECCS Functions. Required Action E.1 is notapplicable to HPCI Function 3.f since the loss of onechannel results in a loss of function (one-out-of-onelogic). This loss was considered during the development ofReference 5 and considered acceptable for the 7 days allowedby Required Action E.2.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."

For Required Action E.I, the Completion Time only beginsupon discovery that a redundant feature in the same system(e.g., both CS subsystems) cannot be automatically initiateddue to inoperable channels within the same Function asdescribed in the paragraph above. The I hour CompletionTime from discovery of loss of initiation capability isacceptable because it minimizes risk while allowing time forrestoration of channels.

If the instrumentation that controls the pump minimum flow Avalve is inoperable, such that the valve will not Wautomatically open, extended pump operation with noinjection path available could lead to pump overheating andfailure. If there were a failure of the instrumentation,such that the valve would not automatically close, a portionof the pump flow could be diverted from the reactor vesselinjection path, causing insufficient core cooling. Theseconsequences can be averted by the operator's manual controlof the valve, which would be adequate to maintain ECCS pumpprotection and required flow. Furthermore, other ECCS pumpswould be sufficient to complete the assumed safety functionif no additional single failure were to occur. The 7 dayCompletion Time of Required Action E.2 to restore theinoperable channel to OPERABLE status is reasonable based onthe remaining capability of the associated ECCS subsystems,the redundancy available in the ECCS design, and the lowprobability of a DBA occurring during the allowed out ofservice time. If the inoperable channel cannot be restoredto OPERABLE status within the allowable out of service time,Condition H must be entered and its Required Action taken.The Required Actions do not allow placing the channel intrip since this action would not necessarily result in asafe state for the channel in all events.

(continued)



BASES

ACTIONS F.1 and F.2(continued)

Required Action F.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within similar ADS trip system A and B Functionsresult in redundant automatic initiation capability beinglost for the ADS. For example, redundant automaticinitiation capability is lost if either (a) one or moreFunction 4.a channel and one or more Function 5.a channelare inoperable and untripped, (b) one or more Function 4.bchannel and one or more Function 5.b channel are inoperableand untripped, (c) one or more Function 4.d channel and oneor more Function 5.d channel are inoperable and untripped,or (d) one Function 4.e channel and one Function 5.e channelare inoperable and untripped.

In this situation (loss of automatic initiation capability),the 96 hour or 8 day allowance, as applicable, of RequiredAction F.2 is not appropriate and all ADS valves must bedeclared inoperable within 1 hour after discovery of loss ofADS initiation capability.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."For Required Action F.1, the Completion Time only beginsupon discovery that the ADS cannot be automaticallyinitiated due to inoperable, untripped channels withinsimilar ADS trip system Functions as described in theparagraph above. The 1 hour Completion Time from discoveryof loss of initiation capability is acceptable because itminimizes risk while allowing time for restoration ortripping of channels.

Because of the diversity of sensors available to provideinitiation signals and the redundancy of the ECCS design, anallowable out of service time of 8 days has been shown to beacceptable (Ref. 5) to permit restoration of any inoperablechannel to OPERABLE status if both HPCI and RCIC areOPERABLE. If either HPCI or RCIC is inoperable, the time isshortened to 96 hours. If the status of HPCI or RCICchanges such that the Completion Time changes from 8 days to96 hours, the 96 hours begins upon discovery of HPCI or RCICinoperability. However, the total time for an inoperable,untripped channel cannot exceed 8 days. If the status of

(continued)



BASES

ACTIONS F.1 and F.2 (continued)

HPCI or RCIC changes such that the Completion Time changesfrom 96 hours to 8 days, the "time zero" for beginning the8 day "clock" begins upon discovery of the inoperable,untripped channel. If the inoperable channel cannot berestored to OPERABLE status within the allowable out ofservice time, the channel must be placed in the trippedcondition per Required Action F.2. Placing the inoperablechannel in trip would conservatively compensate for theinoperability, restore capability to accommodate a singlefailure, and allow operation to continue. Alternately, ifit is not desired to place the channel in trip (e.g., as inthe case where placing the inoperable channel in trip wouldresult in an initiation), Condition H must be entered andits Required Action taken.

G.1 and G.2

Required Action G.1 is intended to ensure that appropriateactions are taken if multiple, inoperable channels withinsimilar ADS trip system Functions result in automaticinitiation capability being lost for the ADS. For example,automatic initiation capability is lost if either (a) oneFunction 4.c channel and one Function 5.c channel areinoperable, (b) a combination of Function 4.f, 4.g, 5.f,and 5.g channels are inoperable such that channelsassociated with five or more low pressure ECCS pumps areinoperable, or (c) one or more Function 4.h channels and oneor more Function 5.h channels are inoperable.

In this situation (loss of automatic initiation capability),the 96 hour or 8 day allowance, as applicable, of RequiredAction G.2 is not appropriate, and all ADS valves must bedeclared inoperable within 1 hour after discovery of loss ofADS initiation capability. The Note to Required Action G.1states that Required Action G.1 is only applicable forFunctions 4.c, 4.f, 4.g, 4.h, 5.c, 5.f, 5.g, and 5.h.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."For Required Action G.1, the Completion Time only begins

(continued)



BASES

ACTIONS G.1 and G.2 (continued)

upon discovery that the ADS cannot be automaticallyinitiated due to inoperable channels within similar ADS tripsystem Functions as described in the paragraph above. The1 hour Completion Time from discovery of loss of initiationcapability is acceptable because it minimizes risk whileallowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provideinitiation signals and the redundancy of the ECCS design, anallowable out of service time of 8 days has been shown to beacceptable (Ref. 5) to permit restoration of any inoperablechannel to OPERABLE status if both HPCI and RCIC areOPERABLE (Required Action G.2). If either HPCI or RCIC isinoperable, the time shortens to 96 hours. If the status ofHPCI or RCIC changes such that the Completion Time changesfrom 8 days to 96 hours, the 96 hours begins upon discoveryof HPCI or RCIC inoperability. However, the total time foran inoperable channel cannot exceed 8 days. If the statusof HPCI or RCIC changes such that the Completion Timechanges from 96 hours to 8 days, the "time zero" forbeginning the 8 day "clock" begins upon discovery of theinoperable channel. If the inoperable channel cannot berestored to OPERABLE status within the allowable out ofservice time, Condition H must be entered and its RequiredAction taken. The Required Actions do not allow placing thechannel in trip since this action would not necessarilyresult in a safe state for the channel in all events.

H.1

With any Required Action and associated Completion Time notmet, the associated feature(s) may be incapable ofperforming the intended function, and the supportedfeature(s) associated with inoperable untripped channelsmust be declared inoperable immediately.

(continued)



BASES (continued)

-SURVEILLANCE As noted in the beginning of the SRs, the SRs for each ECCSREQUIREMENTS instrumentation Function are found in the SRs column of

Table 3.3.5.1-1.

The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may be delayed for up to6 hours as follows: (a) for Functions 3.c and 3.f; and(b) for Functions other than 3.c and 3.f provided theassociated Function or the redundant Function maintains ECCSinitiation capability. Upon completion of the Surveillance,or expiration of the 6 hour allowance, the channel must bereturned to OPERABLE status or the applicable Conditionentered and Required Actions taken. This Note is based onthe reliability analysis (Ref. 5) assumption of the averagetime required to perform channel surveillance. Thatanalysis demonstrated that the 6 hour testing allowance doesnot significantly reduce the probability that the ECCS willinitiate when necessary.

SR 3.3.5.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures -that a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween the instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK guaranteesthat undetected outright channel failure is limited to12 hours; thus, it is key to verifying the instrumentationcontinues to operate properly between each CHANNELCALIBRATION.

Agreement criteria are determined by the plant staff, basedon a combination of the channel instrument uncertainties,including indication and readability. If a channel isoutside the criteria, it may be an indication that theinstrument has drifted outside its limit.

(continued)



BASES



SR 3.3.5.1.2


The Frequency of 92 days is based on the reliabilityanalyses of Reference 5.

SR 3.3.5.1.3 and SR 3.3.5.1.4

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the assumptions of the currentplant specific setpoint methodology.

The 92 day Frequency of SR 3.3.5.1.3 is conservative withrespect to the magnitude of equipment drift assumed in thesetpoint analysis.

The Frequency of SR 3.3.5.1.4 is based upon the assumptionof a 24 month calibration interval in the determination ofthe magnitude of equipment drift in the setpoint analysis.

(continued)



BASES


(continued)

SR 3.3.5.1.5

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required initiation logic for a specificchannel. The system functional testing performed inLCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LCD 3.8.2 overlaps thisSurveillance to complete testing of the assumed safetyfunction.

While this Surveillance can be performed with the reactor atpower for some of the Functions, operating experience hasshown that these components will pass the Surveillance whenperformed at the 24 month Frequency. Therefore, theFrequency was found to be acceptable from a reliabilitystandpoint.




4. NEDC-32163-P, "Peach Bottom Atomic Power Station Units2 and 3, SAFER/GESTR-LOCA, Loss-of-Coolant AccidentAnalysis," January 1993.

5. NEDC-30936-P-A, "BWR Owners' GroupSpecification Improvement AnalysesInstrumentation, Part 2," December

Technicalfor ECCS Actuation1988.


RCIC System InstrumentationB 3.3.5.2


B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation

BASES

BACKGROUND The purpose of the RCIC System instrumentation is toinitiate actions to ensure adequate core cooling when thereactor vessel is isolated from its primary heat sink (themain condenser) and normal coolant makeup flow from theReactor Feedwater System is insufficient or unavailable,such that RCIC System initiation occurs and maintainssufficient reactor water level such that an initiation ofthe low pressure Emergency Core Cooling Systems (ECCS) pumpsdoes not occur. A more complete discussion of RCIC Systemoperation is provided in the Bases of LCO 3.5.3, "RCICSystem."

The RCIC System may be initiated by automatic means.Automatic initiation occurs for conditions of Reactor VesselWater Level--Low Low (Level 2). The variable is monitoredby four transmitters that are connected to four pressurecompensation instruments. The outputs of the pressurecompensation instruments are connected to relays whosecontacts are arranged in a one-out-of-two taken twice logicarrangement. Once initiated, the RCIC logic seals in andcan be reset by the operator only when the reactor vesselwater level signals have cleared.

The RCIC test line isolation valve is closed on a RCICinitiation signal to allow full system flow and maintainprimary containment isolated in the event RCIC is notoperating.

The RCIC System also monitors the water level in thecondensate storage tank (CST) since this is the initialsource of water for RCIC operation. Reactor grade water inthe CST is the normal source. Upon receipt of a RCICinitiation signal, the CST suction valve is automaticallysignaled to open (it is normally in the open position)unless the pump suction from the suppression pool valves isopen. If the water level in the CST falls below apreselected level, first the suppression pool suction valvesautomatically open, and then the CST suction valveautomatically closes. Two level switches are used to detectlow water level in the CST. Either switch can cause thesuppression pool suction valves to open. The opening of the

(continued)



BASES 0BACKGROUND

(continued)suppression pool suction valves causes the CST suction valveto close. This prevents losing suction to the pump whenautomatically transferring suction from the CST to thesuppression pool on low CST level.

The RCIC System provides makeup water to the reactor untilthe reactor vessel water level reaches the high water level(Level 8) setting (two-out-of-two logic), at which time theRCIC steam supply valve closes. The RCIC System restarts ifvessel level again drops to the low level initiation point(Level 2).


The function of the RCIC System is to respond to transientevents by producing makeup coolant to the reactor. The RCICSystem is not an Engineered Safeguard System and no creditis taken in the safety analyses for RCIC System operation.Based on its contribution to the reduction of overall plantrisk, however, the system, and therefore its instrumentationmeets Criterion 4 of NRC Policy Statement.

The OPERABILITY of the RCIC System instrumentation isdependent upon the OPERABILITY of the individualinstrumentation channel Functions specified inTable 3.3.5.2-1. Each Function must have a required numberof OPERABLE channels with their setpoints within thespecified Allowable Values, where appropriate. A channel isinoperable if its actual trip setting is not within itsrequired Allowable Value. The actual setpoint is calibratedconsistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC Systeminstrumentation Function specified in the Table. Tripsetpoints are specified in the setpoint calculations. Thesetpoints are selected to ensure that the settings do notexceed the Allowable Value between CHANNEL CALIBRATIONS.Operation with a trip setting less conservative than thetrip setpoint, but within its Allowable Value, isacceptable. Each Allowable Value specified accounts forinstrument uncertainties appropriate to the Function. Theseuncertainties are described in the setpoint methodology.

(continued)



BASES

APPLICABLE The individual Functions are required to be OPERABLE inSAFETY ANALYSES, MODE 1, and in MODES 2 and 3 with reactor steam domeLCO, and pressure > 150 psig since this is when RCIC is required toAPPLICABILITY be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases

(continued) for the RCIC System.)

The specific Applicable Safety Analyses, LCO, andApplicability discussions are listed below on a Function byFunction basis.

1. Reactor Vessel Water Level-Low Low (Level 2)

Low reactor pressure vessel (RPV) water level indicates thatnormal feedwater flow is insufficient to maintain reactorvessel water level and that the capability to cool the fuelmay be threatened. Should RPV water level decrease too far,fuel damage could result. Therefore, the RCIC System isinitiated at Level 2 to assist in maintaining water levelabove the top of the active fuel.

Reactor Vessel Water Level-Low Low (Level 2) signals areinitiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low (Level 2) AllowableValue is set high enough such that for complete loss offeedwater flow, the RCIC System flow with high pressurecoolant injection assumed to fail will be sufficient toavoid initiation of low pressure ECCS at Level 1.

Four channels of Reactor Vessel Water Level--Low Low(Level 2) Function are available and are required to beOPERABLE when RCIC is required to be OPERABLE to ensure thatno single instrument failure can preclude RCIC initiation.Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)



BASES

APPLICABLE 2. Reactor Vessel Water Level-High (Level 8)SAFETY ANALYSES,LCO, and High RPV water level indicates that sufficient cooling waterAPPLICABILITY inventory exists in the reactor vessel such that there is no

(continued) danger to the fuel. Therefore, the Level 8 signal is usedto close the RCIC steam supply valve to prevent overflowinto the main steam lines (MSLs).

Reactor Vessel Water Level-High (Level 8) signals for RCICare initiated from four level transmitters, which sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel. These four leveltransmitters are connected to two pressure compensationinstruments (channels).

The Reactor Vessel Water Level-High (Level 8) AllowableValue is high enough to preclude isolating the injectionvalve of the RCIC during normal operation, yet low enough totrip the RCIC System prior to water overflowing into theMSLs.

Two channels of Reactor Vessel Water Level--High (Level 8)Function are available and are required to be OPERABLE whenRCIC is required to be OPERABLE to ensure that no singleinstrument failure can preclude RCIC initiation. Refer toLCO 3.5.3 for RCIC Applicability Bases.

3. Condensate Storage Tank Level-Low

Low level in the CST indicates the unavailability of anadequate supply of makeup water from this normal source.Normally, the suction valve between the RCIC pump and theCST is open and, upon receiving a RCIC initiation signal,water for RCIC injection would be taken from the CST.However, if the water level in the CST falls below apreselected level, first the suppression pool suction valvesautomatically open, and then the CST suction valveautomatically closes. This ensures that an adequate supplyof makeup water is available to the RCIC pump. To preventlosing suction to the pump, the suction valves areinterlocked so that the suppression pool suction valves mustbe open before the CST suction valve automatically closes.

(continued)



BASES


3. Condensate Storage Tank Level-Low (continued)

Two level switches are used to detect low water level in theCST. The Condensate Storage Tank Level--Low FunctionAllowable Value is set high enough to ensure adequate pumpsuction head while water is being taken from the CST.

Two channels of the CST Level-Low Function are availableand are required to be OPERABLE when RCIC is required to beOPERABLE to ensure that no single instrument failure canpreclude RCIC swap to suppression pool source. Refer toLCO 3.5.3 for RCIC Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related toRCIC System instrumentation channels. Section 1.3,Completion Times, specifies that once a Condition has beenentered, subsequent divisions, subsystems, components, orvariables expressed in the Condition discovered to beinoperable or not within limits will not result in separateentry into the Condition. Section 1.3 also specifies thatRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable RCIC System instrumentation channels provideappropriate compensatory measures for separate inoperablechannels. As such, a Note has been provided that allowsseparate Condition entry for each inoperable RCIC Systeminstrumentation channel.

A.1I

Required Action A.1 directs entry into the appropriateCondition referenced in.Table 3.3.5.2-1. The applicableCondition referenced in the Table is Function dependent.Each time a channel is discovered to be inoperable,Condition A is entered for that channel and provides fortransfer to the appropriate subsequent Condition.

(continued)



BASES

ACTIONS B.1 and B.2(continued)

Required Action B.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in a complete lossof automatic initiation capability for the RCIC System. Inthis case, automatic initiation capability is lost if twoFunction I channels in the same trip system are inoperableand untripped. In this situation (loss of automaticinitiation capability), the 24 hour allowance of RequiredAction B.2 is not appropriate, and the RCIC System must bedeclared inoperable within 1 hour after discovery of loss ofRCIC initiation capability.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zeron for beginning the allowed outage time "clock."For Required Action B.1, the Completion Time only beginsupon discovery that the RCIC System cannot be automaticallyinitiated due to two or more inoperable, untripped ReactorVessel Water Level-Low Low (Level 2) channels such that thetrip system loses initiation capability. The 1 hourCompletion Time from discovery of loss of initiationcapability is acceptable because it minimizes risk whileallowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provideinitiation signals and the fact that the RCIC System is notassumed in any accident or transient analysis, an allowableout of service time of 24 hours has been shown to beacceptable (Ref. 1) to permit restoration of any inoperablechannel to OPERABLE status. If the inoperable channelcannot be restored to OPERABLE status within the allowableout of service time, the channel must be placed in thetripped condition per Required Action B.2. Placing theinoperable channel in trip would conservatively compensatefor the inoperability, restore capability to accommodate asingle failure, and allow operation to continue.Alternately, if it is not desired to place the channel intrip (e.g., as in the case where placing the inoperablechannel in trip would result in an initiation), Condition Emust be entered and its Required Action taken.

(continued)



BASES


A risk based analysis was performed and determined that anallowable out of service time of 24 hours (Ref. 1) isacceptable to permit restoration of any inoperable channelto OPERABLE status (Required Action C.1). A Required Action(similar to Required Action B.1) limiting the allowable outof service time, if a loss of automatic RCIC initiationcapability exists, is not required. This Condition appliesto the Reactor Vessel Water Level-High (Level 8) Functionwhose logic is arranged such that any inoperable channelwill result in a loss of automatic RCIC initiationcapability (closure of the RCIC steam supply valve). Asstated above, this loss of automatic RCIC initiationcapability was analyzed and determined to be acceptable.The Required Action does not allow placing a channel in tripsince this action would not necessarily result in a safestate for the channel in all events.

D.I. D.2.1. and D.2.2

Required Action D.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in automaticcomponent initiation capability being lost for thefeature(s). For Required Action D.1, the RCIC System is theonly associated feature. In this case, automatic initiationcapability is lost if two Function 3 channels are inoperableand untripped. In this situation (loss of automatic suctionswap), the 24 hour allowance of Required Actions D.2.1and D.2.2 is only appropriate after Action D.1 has beenperformed. Action D.I requires that the RCIC System bedeclared inoperable within I hour from discovery of loss ofRCIC initiation capability. As noted, Required Action D.1is only applicable if the RCIC pump suction is not alignedto the suppression pool since, if aligned, the Function isalready performed.

(continued)



BASES

ACTIONS D.1, D.2.1, and D.2.2 (continued)

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."For Required Action D.1, the Completion Time only beginsupon discovery that the RCIC System cannot be automaticallyaligned to the suppression pool due to two inoperable,untripped channels in the same Function. The 1 hourCompletion Time from discovery of loss of initiationcapability is acceptable because it minimizes risk whileallowing time for restoration or tripping of channels.

Because the RCIC System is not assumed in any accident ortransient analysis, an allowable out of service time of24 hours has been shown to be acceptable (Ref. 1) to permitrestoration of any inoperable channel to OPERABLE status.If the inoperable channel cannot be restored to OPERABLEstatus within the allowable out of service time, the channelmust be placed in the tripped condition per RequiredAction D.2.1, which performs the intended function of thechannel. Alternatively, Required Action D.2.2 allows themanual alignment of the RCIC suction to the suppressionpool, which also performs the intended function. IfRequired Action D.2.1 or D.2.2 is performed, measures shouldbe taken to ensure that the RCIC System piping remainsfilled with water. If it is not desired to perform RequiredActions D.2.1 and D.2.2 (e.g., as in the case where shiftingthe suction source could drain down the RCIC suctionpiping), Condition E must be entered and its Required Actiontaken.

E.1

With any Required Action and associated Completion Time notmet, the RCIC System may be incapable of performing theintended function, and the RCIC System must be declaredinoperable immediately.

(continued)



BASES (continued)

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCICREQUIREMENTS System instrumentation Function are found in the SRs column

of Table 3.3.5.2-1.

The Surveillances are modified by a Note to indicate thatwhen a-channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may be delayed as follows:(a) for up to 6 hours for Function 2 and (b) for up to6 hours for Functions I and 3, provided the associatedFunction maintains trip capability. Upon completion of theSurveillance, or expiration of the 6 hour allowance, thechannel must be returned to OPERABLE status or theapplicable Condition entered and Required Actions taken.This Note is based on the reliability analysis (Ref. 1)assumption of the average time required to perform channelsurveillance. That analysis demonstrated that the 6 hourtesting allowance does not significantly reduce theprobability that the RCIC will initiate when necessary.

SR 3.3.5.2.1

Performance of the CHANNEL CHECK once every 12 hours ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a parameter on other similarchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween the instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION.


(continued)



BASES



SR 3.3.5.2.2


The Frequency of 92 days is based on the reliabilityanalysis of Reference 1.

SR 3.3.5.2.3

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the plant specific setpointmethodology.

The Frequency of SR 3.3.5.2.3 is based upon the assumptionof a 24 month calibration interval in the determination ofthe magnitude of equipment drift in the setpoint analysis.

SR 3.3.5.2.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required initiation logic for a specificchannel. The system functional testing performed inLCO 3.5.3 overlaps this Surveillance to provide completetesting of the safety function.

(continued)



BASES



REFERENCES 1. GENE-770-06-2, "Addendum to Bases for Changes toSurveillance Test Intervals and Allowed Out-of-ServiceTimes for Selected Instrumentation TechnicalSpecifications," February 1991.


Primary Containment Isolation InstrumentationB 3.3.6.1


B 3.3.6.1 Primary Containment Isolation Instrumentation

BASES

BACKGROUND The primary containment isolation instrumentationautomatically initiates closure of appropriate primarycontainment isolation valves (PCIVs). The function of thePCI-Vs, in combination with other accident mitigationsystems, is to limit fission product release during andfollowing postulated Design Basis Accidents (DBAs). Primarycontainment isolation within the time limits specified forthose isolation valves designed to close automaticallyensures that the release of radioactive material to theenvironment will be consistent with the assumptions used inthe analyses for a DBA.

The isolation instrumentation includes the sensors, relays,and switches that are necessary to cause initiation ofprimary containment and reactor coolant pressure boundary(RCPB) isolation. Most channels include electronicequipment (e.g., trip units) that compares measured inputsignals with pre-established setpoints. When the setpointis exceeded, the channel output relay actuates, which thenoutputs a primary containment isolation signal to theisolation logic. Functional diversity is provided bymonitoring a wide range of independent parameters. Theinput parameters to the isolation logics are (a) reactorvessel water level, (b) reactor pressure, (c) main steamline (MSL) flow measurement, (d) main steam line radiation,(e) main steam line pressure, (f) drywell pressure, (g) highpressure coolant injection (HPCI) and reactor core isolationcooling (RCIC) steam line flow, (h) HPCI and RCIC steam linepressure, (i) reactor water cleanup (RWCU) flow, (j) StandbyLiquid Control (SLC) System initiation, (k) area ambienttemperatures, (1) reactor building ventilation and refuelingfloor ventilation exhaust radiation, and (m) main stackradiation. Redundant sensor input signals from eachparameter are provided for initiation of isolation.

Primary containment isolation instrumentation has inputs tothe trip logic of the isolation functions listed below.

(continued)



BASES

BACKGROUND 1. Main Steam Line Isolation(continued)

Most MSL Isolation Functions receive inputs from fourchannels. The outputs from these channels are combined in aone-out-of-two taken twice logic to initiate isolation ofthe Group I isolation valves (MSIVs and MSL drains, MSLsample lines, and recirculation loop sample line valves)To initiate a Group I isolation, both trip systems must betripped.

The exceptions to this arrangement are the Main Steam LineFlow-High Function and Turbine Building Main Steam TunnelTemperature--High Functions. The Main Steam Line Flow-HighFunction uses 16 flow channels, four for each steam line.One channel from each steam line inputs to one of the fourtrip strings. Two trip strings make up each trip system andboth trip systems must trip to cause an MSL isolation. Eachtrip string has four inputs (one per MSL), any one of whichwill trip the trip string. The trip systems are arranged ina one-out-of-two taken twice logic. This is effectively aone-out-of-eight taken twice logic arrangement to initiate aGroup I isolation. The Turbine Building Main Steam TunnelTemperature-High Function receives inputs from twelvechannels, four channels at each of the three differentlocations along the steam line. High temperature on anychannel is not related to a specific MSL. The channels arearranged in a one-out-of-two taken twice logic for eachlocation.

2. Primary Containment Isolation

Most Primary Containment Isolation Functions receive inputsfrom four channels. The outputs from these channels arearranged in a one-out-of-two taken twice logic. Isolationof inboard and outboard primary containment isolation valvesoccurs when both trip systems are in trip.

The exception to this arrangement is the Main Stack MonitorRadiation-High Function. This Function has two channels,whose outputs are arranged in two trip systems which use aone-out-of-one logic. Each trip system isolates one valveper associated penetration. The Main Stack MonitorRadiation-High Function will isolate vent and purge valvesgreater than two inches in diameter during containmentpurging (Ref. 2).

The valves isolated by each of the Primary ContainmentIsolation Functions are listed in Reference 1.

(continued)


Primary Containment Isolation Instrumentation

B 3.3.6.1

BASES

BACKGROUND 3., 4. High Pressure Coolant Injection System Isolation and(continued) Reactor Core Isolation Cooling System Isolation

The Steam Line Flow-High Functions that isolate HPCI andRCIC receive input from two channels, with each channel

comprising one trip system using a one-out-of-one logic.Each of the two trip systems in each isolation group (HPCIand RCIC) is connected to the two valves on each associatedpenetration. Each HPCI and RCIC Steam Line Flow-Highchannel has a time delay relay to prevent isolation due toflow transients during startup.

The HPCI and RCIC Isolation Functions for DrywellPressure-High and Steam Supply Line Pressure-Low receiveinputs from four channels. The outputs from these channelsare combined in a one-out-of-two taken twice logic toinitiate isolation of the associated valves.

The HPCI and RCIC Compartment and Steam Line AreaTemperature--High Functions receive input from 16 channels,four channels at each of four different locations. Thechannels are arranged in a one-out-of-two taken twice logicfor each location.

The HPCI and RCIC Steam Line Flow-High Functions, SteamSupply Line Pressure-Low Functions, and Compartment andSteam Line Area Temperature--High Functions isolate theassociated steam supply and turbine exhaust valves and pumpsuction valves. The HPCI and RCIC Drywell Pressure-HighFunctions isolate the HPCI and RCIC test return line valves.The HPCI and RCIC Drywell Pressure-High Functions, inconjunction with the Steam Supply Line Pressure-LowFunctions, isolate the HPCI and RCIC turbine exhaust vacuumrelief valves.

5. Reactor Water Cleanup System Isolation

The Reactor Vessel Water Level-Low (Level 3) IsolationFunction receives input from four reactor vessel water levelchannels. The outputs from the reactor vessel water level

channels are connected into a one-out-of-two taken twicelogic which isolates both the inboard and outboard isolationvalves. The RWCU Flow-High Function receives input fromtwo channels, with each channel in one trip system using aone-out-of-one logic, with one channel tripping the inboardvalve and one channel tripping the outboard valves. The SLC

(continued)



BASES

BACKGROUND 5. Reactor Water Cleanup System Isolation (continued)

System Isolation Function receives input from two channelswith each channel in one trip system using a one-out-of-onelogic. When either SLC pump is started remotely, onechannel trips the inboard isolation valve and one channelisolates the outboard isolation valves.

The RWCU Isolation Function isolates the inboard andoutboard RWCU pump suction penetration and the outboardvalve at the RWCU connection to reactor feedwater.

6. Shutdown Cooling System Isolation

The Reactor Vessel Water Level-Low (Level 3) Functionreceives input from four reactor vessel water levelchannels. The outputs from the channels are connected to aone-out-of-two taken twice logic, which isolates both valveson the RHR shutdown cooling pump suction penetration. TheReactor Pressure-High Function receives input from twochannels, with each channel in one trip system using aone-out-of-one logic. Each trip system is connected to bothvalves on the RHR shutdown cooling pump suction penetration.

7. Feedwater Recirculation Isolation

The Reactor Pressure-High Function receives inputs fromfour channels. The outputs from the four channels areconnected into a one-out-of-two taken twice logic whichisolates the feedwater recirculation valves.

8. Traversing Incore Probe System Isolation

The Reactor Vessel Water Level-Low, Level 3 IsolationFunction receives input from two reactor vessel water levelchannels. The outputs from the reactor vessel water levelchannels are connected into one two-out-of-two logic tripsystem. The Drywell Pressure-High Isolation functionreceives input from two drywell pressure channels. Theoutputs from the drywell pressure channels are connected into

*one two-out-of-two logic trip system.

When either Isolation Function actuates, the TIP drivemechanisms will withdraw the TIPs, if inserted, and closethe TIP system isolation ball valves when the TIPs are fullywithdrawn. The redundant TIP system isolation valves aremanual shear valves.

TIP System Isolation Functions isolate the Group II(D) TIPvalves (isolation ball valves).

(continued)



BASES

APPLICABLE The isolation signals generated by the primary containmentSAFETY ANALYSES, isolation instrumentation are implicitly assumed in theLCO, and safety analyses of References I and 3 to initiate closureAPPLICABILITY of valves to limit offsite doses. Refer to LCO 3.6.1.3,

"Primary Containment Isolation Valves (PCIVs)," ApplicableSafety Analyses Bases for more detail of the safetyanalyses.

Primary containment isolation instrumentation satisfiesCriterion 3 of the NRC Policy Statement. Certaininstrumentation Functions are retained for other reasons andare described below in the individual Functions discussion.

The OPERABILITY of the primary containment instrumentationis dependent on the OPERABILITY of the individualinstrumentation channel Functions specified inTable 3.3.6.1-1. Each Function must have a required numberof OPERABLE channels, with their setpoints within thespecified Allowable Values, where appropriate. A channel isinoperable if its actual trip setting is not within itsrequired Allowable Value. The actual setpoint is calibratedconsistent with applicable setpoint methodology assumptions.

Allowable Values, where applicable, are specified for eachPrimary Containment Isolation Function specified in theTable. Trip setpoints are specified in the setpointcalculations. The trip setpoints are selected to ensurethat the setpoints do not exceed the Allowable Value betweenCHANNEL CALIBRATIONS. Operation with a trip setting lessconservative than the trip setpoint, but within itsAllowable Value, is acceptable. Trip setpoints are thosepredetermined values of output at which an action shouldtake place. The setpoints are compared to the actualprocess parameter (e.g., reactor vessel water level), andwhen the measured output value of the process parameterexceeds the setpoint, the associated device (e.g., tripunit) changes state. The analytic or design limits arederived from the limiting values of the process parametersobtained from the safety analysis or other appropriatedocuments. The Allowable Values are derived from theanalytic or design limits, corrected for calibration,process, and instrument errors. The trip setpoints aredetermined from analytical or design limits, corrected forcalibration, process, and instrument errors, as well as,instrument drift. In selected cases, the Allowable Valuesand trip setpoints are determined by engineering judgementor historically accepted practice relative to the intendedfunction of the channel. The trip setpoints determined inthis manner provide adequate protection by assuringinstrument and process uncertainties expected for theenvironments during the operating time of the associatedchannels are accounted for.

Certain Emergency Core Cooling Systems (ECCS) and RCICvalves (e.g., minimum flow) also serve the dual function ofautomatic PCIVs. The signals that isolate these valves arealso associated with the automatic initiation of the ECCS

(continued)



BASES

APPLICABLE and RCIC. The instrumentation requirements and ACTIONSSAFETY ANALYSES, associated with these signals are addressed in LCO 3.3.5.1,LCO, and "Emergency Core Cooling Systems (ECCS) Instrumentation," andAPPLICABILITY LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System

(continued) Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to beOPERABLE in MODES 1, 2, and 3 consistent with theApplicability for LCO 3.6.1.1, "Primary Containment."Functions that have different Applicabilities are discussedbelow in the individual Functions discussion.


Main Steam Line Isolation

l.a. Reactor Vessel Water Level-Low Low Low (Level 1)

Low reactor pressure vessel (RPV) water level indicates thatthe capability to cool the fuel may be threatened. ShouldRPV water level decrease too far, fuel damage could result.Therefore, isolation of the MSIVs and other interfaces withthe reactor vessel occurs to prevent offsite dose limitsfrom being exceeded. The Reactor Vessel Water Level-Low LowLow (Level 1) Function is one of the many Functions assumedto be OPERABLE and capable of providing isolation signals.The Reactor Vessel Water Level-Low Low Low (Level 1)Function associated with isolation is assumed in theanalysis of the recirculation line break (Ref. 1). Theisolation of the MSLs on Level I supports actions to ensurethat offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from fourlevel transmitters that sense the difference between thepressure due to a constant column of water (reference leg)and the pressure due to the actual water level (variableleg) in the vessel. Four channels of Reactor Vessel WaterLevel--Low Low Low (Level 1) Function are available and arerequired to be OPERABLE to ensure that no single instrumentfailure can preclude the isolation function.

(continued)



BASES

APPLICABLE I.a. Reactor Vessel Water Level-Low Low Low (Level 1)SAFETY ANALYSES, (continued)LCO, andAPPLICABILITY The Reactor Vessel Water Level-Low Low Low (Level 1)

Allowable Value is chosen to be the same as the ECCS Level 1Allowable Value (LCO 3.3.5.1) to ensure that the MSLsisolate on a potential loss of coolant accident (LOCA) toprevent offsite doses from exceeding 10 CFR 100 limits.

This Function isolates MSIVs, MSL drains, MSL sample linesand recirculation loop sample line valves.

I.b. Main Steam Line Pressure-Low

Low MSL pressure indicates that there may be a problem withthe turbine pressure regulation, which could result in a lowreactor vessel water level condition and the RPV coolingdown more than 100"F/hr if the pressure loss is allowed tocontinue. The Main Steam Line Pressure-Low Function isdirectly assumed in the analysis of the pressure regulatorfailure (Ref. 3). For this event, the closure of the MSIVsensures that the RPV temperature change limit (100"F/hr) isnot reached. In addition, this Function supports actions toensure that Safety Limit 2.1.1.1 is not exceeded. (ThisFunction closes the MSIVs prior to pressure decreasing below785 psig, which results in a scram due to MSIV closure, thusreducing reactor power to < 25% RTP.)

The MSL low pressure signals are initiated from fourtransmitters that are connected to the MSL header. Thetransmitters are arranged such that, even though physicallyseparated from each other, each transmitter is able todetect low MSL pressure. Four channels of Main Steam LinePressure-Low Function are available and are required to beOPERABLE to ensure that no single instrument failure canpreclude the isolation function.

The Allowable Value was selected to be high enough toprevent excessive RPV depressurization.

The Main Steam Line Pressure.-Low Function is only requiredto be OPERABLE in MODE 1 since this is when the assumedtransient can occur (Ref. 1).


(continued)



BASES


(continued)

l.c. Main Steam Line Flow-High

Main Steam Line Flow-High is provided to detect a break ofthe MSL and to initiate closure of the MSIVs. If the steamwere allowed to continue flowing out of the break, thereactor would depressurize and the core could uncover. Ifthe RPV water level decreases too far, fuel damage couldoccur. Therefore, the isolation is initiated on high flowto prevent or minimize core damage. The Main Steam LineFlow-High Function is directly assumed in the analysis ofthe main steam line break (MSLB) (Ref. 3). The isolationaction, along with the scram function of the ReactorProtection System (RPS), ensures that the fuel peak claddingtemperature remains below the limits of 10 CFR 50.46 andoffsite doses do not exceed the 10 CFR 100 limits.

The MSL flow signals are initiated from 16 transmitters thatare connected to the four MSLs. The transmitters arearranged such that, even though physically separated fromeach other, all four connected to one MSL would be able todetect the high flow. Four channels of Main Steam LineFlow-High Function for each MSL (two channels per tripsystem) are available and are required to be OPERABLE sothat no single instrument failure will preclude detecting abreak in any individual MSL.

The Allowable Value is chosen to ensure that offsite doselimits are not exceeded due to the break.


I.d. Main Steam Line-High Radiation

The Main Steam Line-High Radiation Function is provided todetect gross release of fission products from the fuel andto initiate closure of the MSIVs. The trip setting is setlow enough so that a high radiation trip results from adesign basis rod drop accident and high enough abovebackground radiation levels in the vicinity of the mainsteam lines so that spurious trips at rated power areavoided. The Main Steam Line-High Radiation Function isdirectly assumed in the analysis of the control rod dropaccident (Ref. 3).

(continued)



B 3.3.6.1

BASES

APPLICABLE 1.d. Main Steam Line-High Radiation (continued)SAFETY ANALYSES,LCO, and The Main Steam Line-High Radiation signals are initiatedAPPLICABILITY from four gamma sensitive instruments. Four channels are

available and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction.

The Allowable Value is chosen to ensure that offsite doselimits are not exceeded.


i.e Turbine Building Main Steam Tunnel Temperature-High

The Turbine Building Main Steam Tunnel Temperature Functionis provided to detect a break in a main steam line andprovides diversity to the high flow instrumentation.

Turbine Building Main Steam Tunnel Temperature signals areinitiated from resistance temperature detectors (RTDs)located along the main steam line between the ReactorBuilding and the turbine. Twelve channels of TurbineBuilding Main Steam Tunnel Temperature-High Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction.

The Allowable Value is chosen to detect a leak equivalent tobetween 1% and 10% rated steam flow.


l.f. Reactor Building Main Steam Tunnel Temperature-High

The Reactor Building Main Steam Tunnel Temperature Functionis provided to detect a break in a main steam line andprovides diversity to the high flow instrumentation.

Reactor Building Main Steam Tunnel Temperature signals areinitiated from resistance temperature detectors (RTDs)located in the Main Steam Line Tunnel ventilation exhaustduct. Four channels of Reactor Building Main Steam TunnelTemperature--High Function are available and are required tobe OPERABLE to ensure that no single instrument failure can

preclude the isolation function.

(continued)



B 3.3.6.1

BASES


l.f Reactor Building Main Steam Tunnel Temperature-High(continued)

The Allowable Value is chosen to detect a leak equivalent tobetween 1% and 10% rated steam flow.


Primary Containment Isolation

2.a. Reactor Vessel Water Level-Low (Level 3)

Low RPV water level indicates that the capability to coolthe fuel may be threatened. The valves whose penetrationscommunicate with the primary containment are isolated tolimit the release of fission products. The isolation of theprimary containment on Level 3 supports actions to ensurethat offsite dose limits of 10 CFR 100 are not exceeded.

(continued)

I PBAPS UNIT 2 B 3.3-149a Revision No. 48


BASES

APPLICABLE 2.a. Reactor Vessel Water Level-Low (Level 3) (continued)SAFETY ANALYSES,LCO, and The Reactor Vessel Water Level-Low (Level 3) FunctionAPPLICABILITY associated with isolation is implicitly assumed in the UFSAR

analysis as these leakage paths are assumed to be isolatedpost LOCA.

Reactor Vessel Water Level-Low (Level 3) signals areinitiated from level transmitters that sense the differencebetween the pressure due to a constant column of water(reference leg) and the pressure due to the actual waterlevel (variable leg) in the vessel. Four channels ofReactor Vessel Water Level-Low (Level 3) Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction.

The Reactor Vessel Water Level-Low (Level 3) AllowableValue was chosen to be the same as the RPS Level 3 scramAllowable Value (LCO 3.3.1.1), since isolation of thesevalves is not critical to orderly plant shutdown.

This Function isolates the Group If(A) valves listed inReference 1 with the exception of RWCU isolation valves andRHR shutdown cooling pump suction valves which are addressed Win Functions 5.c and 6.b, respectively.

2.b. Drywell Pressure-High

High drywell pressure can indicate a break in the RCPBinside the primary containment. The isolation of some ofthe primary containment isolation valves on high drywellpressure supports actions to ensure that offsite dose limitsof 10 CFR 100 are not exceeded. The Drywell Pressure-HighFunction, associated with isolation of the primarycontainment, is implicitly assumed in the UFSAR accidentanalysis as these leakage paths are assumed to be isolatedpost LOCA.

High drywell pressure signals are initiated from pressuretransmitters that sense the pressure in the drywell. Fourchannels of Drywell Pressure-High are available and arerequired to be OPERABLE to ensure that no single instrumentfailure can preclude the isolation function.

(continued)



BASES

APPLICABLE 2.b. Drywell Pressure-High (continued)SAFETY ANALYSES,LCO, and The Allowable Value was selected to be the same as the ECCSAPPLICABILITY Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since

this may be indicative of a LOCA inside primary containment.

This Function isolates the Group II(B) valves listed inReference 1.

2.c. Main Stack Monitor Radiation-High

Main stack monitor radiation is an indication that therelease of radioactive material may exceed establishedlimits. Therefore, when Main Stack Monitor Radiation-Highis detected when there is flow through the Standby GasTreatment System, an isolation of primary containment purgesupply and exhaust penetrations is initiated to limit therelease of fission products. However, this Function is notassumed in any accident or transient analysis in the UFSARbecause other leakage paths (e.g., MSIVs) are more limiting.

The drywell radiation signals are initiated from radiationdetectors that isokinetically sample the main stackutilizing sample pumps. Two channels of Main StackRadiation-High Function are available and are required tobe OPERABLE to ensure that no single instrument failure canpreclude the isolation function.

The Allowable Value is set below the maximum allowablerelease limit in accordance with the Offsite DoseCalculation Manual (ODCM).

This Function isolates the containment vent and purge valvesand other Group Ill(E) valves listed in Reference 1.

2.d., 2.e. Reactor Building Ventilation and Refueling FloorVentilation Exhaust Radiation-High

High secondary containment exhaust radiation is anindication of possible gross failure of the fuel cladding.The release may have originated from the primary containmentdue to a break in the RCPB. When Reactor Building orRefueling Floor Ventilation Exhaust Radiation-High isdetected, the affected ventilation pathway and primary

(continued)



BASES

APPLICABLE 2.d., 2.e. Reactor Building Ventilation and Refueling FloorSAFETY ANALYSES, Ventilation Exhaust Radiation-High (continued)LCO, andAPPLICABILITY containment purge supply and exhaust valves are isolated to

limit the release of fission products. Additionally,Ventilation Exhaust Radiation-High Function initiatesStandby Gas Treatment System.

The Ventilation Exhaust Radiation-High signals areinitiated from radiation detectors that are located on theventilation exhaust piping coming from the reactor buildingand the refueling floor zones, respectively. The signalfrom each detector is input to an individual monitor whosetrip outputs are assigned to an isolation channel. Fourchannels of Reactor Building Ventilation Exhaust-HighFunction and four channels of Refueling Floor VentilationExhaust-High Function are available and are required to beOPERABLE to ensure that no single instrument failure canpreclude the isolation function.

The Allowable Values are chosen to promptly detect grossfailure of the fuel cladding during a refueling accident.

These Functions isolate the Group Ill(C) and Ill(D) valveslisted in Reference 1.

High Pressure Coolant Injection and Reactor Core IsolationCooling Systems Isolation

3.a.. 3.b., 4.a.. 4.b. HPCI and RCIC Steam Line Flow-Highand Time Delay Relays

Steam Line Flow-High Functions are provided to detect abreak of the RCIC or HPCI steam lines and initiate closureof the steam line isolation valves of the appropriatesystem. If the steam is allowed to continue flowing out ofthe break, the reactor will depressurize and the core canuncover. Therefore, the isolations are initiated on highflow to prevent or minimize core damage. The isolationaction, along with the scram function of the RPS, ensuresthat the fuel peak cladding temperature remains below thelimits of 10 CFR 50.46. Specific credit for these Functionsis not assumed in any UFSAR accident analyses since the

(continued)



BASES

APPLICABLE 3.a., 3.b., 4.a., 4.b. HPCI and RCIC Steam Line Flow-HighSAFETY ANALYSES, and Time Delay Relays (continued)LCO, andAPPLICABILITY bounding analysis is performed for large breaks such as

recirculation and MSL breaks. However, these instrumentsprevent the RCIC or HPCI steam line breaks from becomingbounding.

The HPCI and RCIC Steam Line Flow-High signals areinitiated from transmitters (two for HPCI and two for RCIC)that are connected to the system steam lines. A time delayis provided to prevent isolation due to high flow transientsduring startup with one Time Delay Relay channel associatedwith each Steam Line Flow-High channel. Two channels ofboth HPCI and RCIC Steam Line Flow-High Functions and theassociated Time Delay Relays are available and are requiredto be OPERABLE to ensure that no single instrument failurecan preclude the isolation function.

The Allowable Values for Steam Line Flow-High Function andassociated Time Delay Relay Function are chosen to be lowenough to ensure that the trip occurs to maintain the MSLBevent as the bounding event.

These Functions isolate the associated HPCI and RCIC steam

supply and turbine exhaust valves and pump suction valves.

3.c., 4.c. HPCI and RCIC Steam Supply Line Pressure-Low

Low MSL pressure indicates that the pressure of the steam inthe HPCI or RCIC turbine may be too low to continueoperation of the associated system's turbine. Theseisolations prevent radioactive gases and steam from escapingthrough the pump shaft seals into the reactor building butare primarily for equipment protection and are also assumedfor long term containment isolation. However, they alsoprovide a diverse signal to indicate a possible systembreak. These instruments are included in TechnicalSpecifications (TS) because of the potential for risk due topossible failure of the instruments preventing HPCI and RCICinitiations (Ref. 4).

The HPCI and RCIC Steam Supply Line Pressure-Low signalsare initiated from transmitters (four for HPCI and four forRCIC) that are connected to the system steam line. Four

(continued)



BASES

APPLICABLE 3.c.. 4.c. HPCI and RCIC Steam Supply Line Pressure-LowSAFETY ANALYSES, (continued)LCO, andAPPLICABILITY channels of both HPCI and RCIC Steam Supply Line

Pressure-Low Functions are available and are required to beOPERABLE to ensure that no single instrument failure canpreclude the isolation function.

The Allowable Values are selected to be high enough toprevent damage to the system's turbine.

These Functions isolate the associated HPCI and RCIC steamsupply and turbine exhaust valves and pump suction valves.

3.d.. 4.d. Drywell Pressure-High (Vacuum Breakers)

High drywell pressure can indicate a break in the RCPB. TheHPCI and RCIC isolation of the turbine exhaust vacuumbreakers is provided to prevent communication with thedrywell when high drywell pressure exists. The HPCI andRCIC turbine exhaust vacuum breaker isolation occursfollowing a permissive from the associated Steam Supply LinePressure-Low Function which indicates that the system is nolonger required or capable of performing coolant injection.The isolation of the HPCI and RCIC turbine exhaust vacuumbreakers by Drywell Pressure-High is indirectly assumed inthe UFSAR accident analysis because the turbine exhaustleakage path is not assumed to contribute to offsite doses.

High drywell pressure signals are initiated from pressuretransmitters that sense the pressure in the drywell. Fourchannels for both HPCI and RCIC Drywell Pressure-High(Vacuum Breakers) Functions are available and are requiredto be OPERABLE to ensure that no single instrument failurecan preclude the isolation function.

The Allowable Value was selected to be the same as the ECCSDrywell Pressure-High Allowable Value (LCO 3.3.5.1), sincethis is indicative of a LOCA inside primary containment.

This Function isolates the associated HPCI and RCIC vacuumrelief valves and test return line valves.

(continued)



BASES

APPLICABLESAFETY ANALYSESLCO, andAPPLICABILITY

(continued)

3.e., 4.e. HPCI and RCIC Compartment and Steam Line AreaTemperature -High

HPCI and RCIC Compartment and Steam Line Area temperaturesare provided to detect a leak from the associated systemsteam piping. The isolation occurs when a very small leakhas occurred and is diverse to the high flowinstrumentation. If the small leak is allowed to continuewithout isolation, offsite dose limits may be reached.

These Functions are not assumed in any UFSAR transient oraccident analysis, since bounding analyses are performed forlarge breaks such as recirculation or MSL breaks.

HPCI and RCIC Compartment and Steam Line AreaTemperature-High signals are initiated from resistancetemperature detectors (RTDs) that are appropriately locatedto protect the system that is being monitored. The HPCI andRCIC Compartment and Steam Line Area Temperature-HighFunctions each use 16 temperature channels. Sixteenchannels for each HPCI and RCIC Compartment and Steam LineArea Temperature-High Function are available and arerequired to be OPERABLE to ensure that no single instrumentfailure can preclude the isolation function.

The Allowable Values are set low enough to detect a leak.

These Functions isolate the associated HPCI and RCIC steamsupply and turbine exhaust valves and pump suction valves.

Reactor Water Cleanup (RWCU) System Isolation

5.a. RWCU Flow-High

The high flow signal is provided to detect a break in theRWCU System. Should the reactor coolant continue to flowout of the break, offsite dose limits may be exceeded.Therefore, isolation of the RWCU System is initiated whenhigh RWCU flow is sensed to prevent exceeding offsite doses.This Function is not assumed in any UFSAR transient oraccident analysis, since bounding analyses are performed forlarge breaks such as MSLBs.

(continued)



BASES

APPLICABLE 5.a. RWCU Flow-High (continued)SAFETY ANALYSES,LCO, and The high RWCU flow signals are initiated from transmittersAPPLICABILITY that are connected to the pump suction line of the RWCU

System. Two channels of RWCU Flow-High Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction.

The RWCU Flow-High Allowable Value ensures that a break ofthe RWCU piping is detected.

This Function isolates the inboard and outboard RWCU pumpsuction penetration and the outboard valve at the RWCUconnection to reactor feedwater.

5.b. Standby Liquid Control (SLC) System Initiation

The isolation of the RWCU System is required when the SLCSystem has been initiated to prevent dilution and removal ofthe boron solution by the RWCU System (Ref. 5). SLC Systeminitiation signals are initiated from the remote SLC Systemstart switch.

There is no Allowable Value associated with this Functionsince the channels are mechanically actuated based solely onthe position of the SLC System initiation switch.

Two channels of the SLC System Initiation Function areavailable and are required to be OPERABLE only in MODES 1and 2, since these are the only MODES where the reactor canbe critical, and these MODES are consistent with theApplicability for the SLC System (LCO 3.1.7).

This Function isolates the inboard and outboard RWCU pumpsuction penetration and the outboard valve at the RWCUconnection to reactor feedwater.

5.c. Reactor Vessel Water Level--Low (Level 3)

Low RPV water level indicates that the capability to coolthe fuel may be threatened. Should RPV water level decreasetoo far, fuel damage could result. Therefore, isolation ofsome interfaces with the reactor vessel occurs to isolatethe potential sources of a break. The isolation of the RWCUSystem on Level 3 supports actions to ensure that the fuel

(continued)



BASES

APPLICABLE 5.c. Reactor Vessel Water Level-Low (Level 3) (continued)SAFETY ANALYSES,LCO, and peak cladding temperature remains below the limits ofAPPLICABILITY 10 CFR 50.46. The Reactor Vessel Water Level--Low (Level 3)

Function associated with RWCU isolation is not directlyassumed in the UFSAR safety analyses because the RWCU Systemline break is bounded by breaks of larger systems(recirculation and MSL breaks are more limiting).

Reactor Vessel Water Level-Low (Level 3) signals areinitiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel. Four channels ofReactor Vessel Water Level-Low (Level 3) Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction.

The Reactor Vessel Water Level-Low (Level 3) AllowableValue was chosen to be the same as the RPS Roactor VesselWater Level-Low (Level 3) Allowable Value (LCO 3.3.1.1),since the capability to cool the fuel may be'threatened.

This Function isolates the inboard and outboard RWCU suctionpenetration and the outboard valve at the RWCU connection toreactor feedwater.

Shutdown Cooling System Isolation

6.a. Reactor Pressure-High

The Reactor Pressure-High Function is provided to isolatethe shutdown cooling portion of the Residual Heat Removal(RHR) System. This Function is provided only for equipmentprotection to prevent an intersystem LOCA scenario, andcredit for the Function is not assumed in the accident ortransient analysis in the UFSAR.

The Reactor Pressure-High signals are initiated from twoswitches that are connected to different taps on the RPV.Two channels of Reactor Pressure-High Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction. The Function is only required to be OPERABLE in

(continued)



BASES

APPLICABLE 6.a. Reactor Pressure-High (continued)SAFETY ANALYSES,LCO, and MODES 1, 2, and 3, since these are the only MODES in whichAPPLICABILITY the reactor can be pressurized; thus, equipment protection

is needed. The Allowable Value was chosen to be low enoughto protect the system equipment from overpressurization.

This Function isolates both RHR shutdown cooling pumpsuction valves.

6.b. Reactor Vessel Water Level-Low (Level 3)

Low RPV water level indicates that the capability to coolthe fuel may be threatened. Should RPV water level decreasetoo far, fuel damage could result. Therefore, isolation ofsome reactor vessel interfaces occurs to begin isolating thepotential sources of a break. The Reactor Vessel WaterLevel-Low (Level 3) Function associated with RHR ShutdownCooling System isolation is not directly assumed in safetyanalyses because a break of the RHR Shutdown Cooling Systemis bounded by breaks of the recirculation and MSL. The RHRShutdown Cooling System isolation on Level 3 supportsactions to ensure that the RPV water level does not dropbelow the top of the active fuel during a vessel draindownevent caused by a leak (e.g., pipe break or inadvertentvalve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level-Low (Level 3) signals areinitiated from four level transmitters that sense thedifference between the pressure due to a constant column ofwater (reference leg) and the pressure due to the actualwater level (variable leg) in the vessel. Four channels(two channels per trip system) of the Reactor Vessel WaterLevel--Low (Level 3) Function are available and are requiredto be OPERABLE to ensure that no single instrument failurecan preclude the isolation function. As noted (footnote (a)to Table 3.3.6.1-1), only one channel per trip system (withan isolation signal available to one shutdown cooling pumpsuction isolation valve) of the Reactor Vessel WaterLevel--Low (Level 3) Function are required to be OPERABLE inMODES 4 and 5, provided the RHR Shutdown Cooling Systemintegrity is maintained. System integrity is maintainedprovided the piping is intact and no maintenance is beingperformed that has the potential for draining the reactorvessel through the system.

(continued)



B 3.3.6.1

BASES

APPLICABLE 6.b. Reactor Vessel Water Level-Low (Level 3) (continued)SAFETY ANALYSES,LCO, and The Reactor Vessel Water Level-Low (Level 3) AllowableAPPLICABILITY Value was chosen to be the same as the RPS Reactor Vessel

Water Level-Low (Level 3) Allowable Value (LCO 3.3.1.1),since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level-Low (Level 3) Function isonly required to be OPERABLE in MODES 3, 4, and 5 to preventthis potential flow path from lowering the reactor vessellevel to the top of the fuel. In MODES 1 and 2, anotherisolation (i.e., Reactor Pressure-High) and administrativecontrols ensure that this flow path remains isolated toprevent unexpected loss of inventory via this flow path.

This Function isolates both RHR shutdown cooling pumpsuction valves.

Feedwater Recirculation Isolation

7.a. Reactor Pressure-High

The Reactor Pressure-High Function is provided to isolatethe feedwater recirculation line. This interlock isprovided only for equipment protection to prevent anintersystem LOCA scenario, and credit for the interlock isnot assumed in the accident or transient analysis in theUFSAR.

The Reactor Pressure-High signals are initiated from fourtransmitters that are connected to different taps on theRPV. Four channels of Reactor Pressure-High Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction. The Function is only required to be OPERABLE inMODES 1, 2, and 3, since these are the only MODES in whichthe reactor can be pressurized; thus, equipment protectionis needed. The Allowable Value was chosen to be low enoughto protect the system equipment from overpressurization.

This Function isolates the feedwater recirculation valves.

Traversing Incore Probe System Isolation

8.a. Reactor Vessel Water Level-Low, Level 3

Low RPV water level indicates that the capability to cool thefuel may be threatened. The valves whose penetrationscommunicate with the primary containment are isolated to

(continued)



BASES

APPLICABLE 8.a. Rea cto r Vessel1 Wa te.r Le.ve -Low, Level 3 (continued)SAFETY ANALYSES,LCO, and limit the release of fission products. The isolation of theAPPLICABILITY primary containment on Level 3 supports actions to ensure that

(continued) offsite dose limits of 10 CFR 100 are not exceeded. TheReactor Vessel Water Level-Low, Level 3 Function associatedwith isolation is implicitly assumed in the FSAR analysis asthese leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level-Low, Level 3 signals are initiatedfrom level transmitters that sense the difference between thepressure due to a constant column of water (reference leg) andthe pressure due to the actual water level (variable leg) inthe vessel. Two channels of Reactor Vessel Water Level-Low,Level 3 Function are available and are required to be OPERABLEto ensure that no single instrument failure can initiate aninadvertent isolation actuation. The isolation function isensured by the manual shear valve in each penetration.

The Reactor Vessel Water Level-Low, Level 3 Allowable Value waschosen to be the same as the RPS Level 3 scram Allowable Value(LCO 3.3.1.1), since isolation of these valves is not criticalto orderly plant shutdown.

This Function isolates the Group II(D) TIP valves.

8.b. Drvwell Pressure-High

High drywell pressure can indicate a break in the RCPB insidethe primary containment. The isolation of some of the primarycontainment isolation valves on high drywell pressure supportsactions to ensure that offsite dose limits of 10 CFR 100 arenot exceeded. The Drywell Pressure-High Function, associatedwith isolation of the primary containment, is implicitlyassumed in the FSAR accident analysis as these leakage pathsare assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressuretransmitters that sense the pressure in the drywell. Twochannels of Drywell Pressure-High per Function are availableand are required to be OPERABLE to ensure that no singleinstrument failure can initiate an inadvertent actuation. Theisolation function is ensured by the manual shear valve in eachpenetration.

The allowable Value was selected to be the same as the ECCSDrywell Pressure-High Allowable Value (LCO 3.3.5.1), since thismay be indicative of a LOCA inside primary containment.

This Function isolates the Group II(D) TIP valves.

(continued)



BASES (continued)

ACTIONS The ACTIONS are modified by two Notes. Note 1 allowspenetration flow path(s) to be unisolated intermittently underadministrative controls. These controls consist of stationinga dedicated operator at the controls of the valve, who is incontinuous communication with the control room. In this way,the penetration can be rapidly isolated when a need for primarycontainment isolation is indicated. Note 2 has been providedto modify the ACTIONS related to primary containment isolationinstrumentation channels. Section 1.3, Completion Times,specifies that once a Condition has been entered, subsequentdivisions, subsystems, components, or variables expressed inthe Condition, discovered to be inoperable or not withinlimits, will not result in separate entry into the Condition.Section 1.3 also specifies that Required Actions of theCondition continue to apply for each additional failure, withCompletion Times based on initial entry into the Condition.However, the Required Actions for inoperable primarycontainment isolation instrumentation channels provideappropriate compensatory measures for separate inoperablechannels. As such, a Note has been provided that allowsseparate Condition entry for each inoperable primarycontainment isolation instrumentation channel.

A.1

Because of the diversity of sensors available to provideisolation signals and the redundancy of the isolationdesign, an allowable out of service time of 12 hours forFunctions 1.d, 2.a, and 2.b and 24 hours for Functions otherthan Functions 1.d, 2.a, and 2.b has been shown to beacceptable (Refs. 6 and 7) to permit restoration of anyinoperable channel to OPERABLE status. This out of servicetime is only acceptable provided the associated Function isstill maintaining isolation capability (refer to RequiredAction B.1 Bases). If the inoperable channel cannot berestored to OPERABLE status within the allowable out ofservice time, the channel must be placed in the trippedcondition per Required Action A.1. Placing the inoperablechannel in trip would conservatively compensate for theinoperability, restore capability to accommodate a singlefailure, and allow operation to continue with no furtherrestrictions. Alternately, if it is not desired to placethe channel in trip (e.g., as in the case where placing theinoperable channel in trip would result in an isolation),Condition C must be entered and its Required Action taken.

(continued)



B 3.3.6.1

BASES

ACTIONS B.1

(continued)Required Action B.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in redundantisolation capability being lost for the associatedpenetration flow path(s). For those MSL, PrimaryContainment, HPCI, RCIC, RWCU, SDC, and FeedwaterRecirculation Isolation Functions, where actuation of bothtrip systems is needed to isolate a penetration, theFunctions are considered to be maintaining isolationcapability when sufficient channels are OPERABLE or in trip(or the associated trip system in trip), such that both tripsystems will generate a trip signal from the given Functionon a valid signal. For those Primary Containment, HPCI,RCIC, RWCU, and SDC isolation functions, where actuation ofone trip system is needed to isolate a penetration, theFunctions are considered to be maintaining isolationcapability when sufficient channels are OPERABLE or in trip,such that one trip system will generate a trip signal fromthe given function on a valid signal. This ensures that atleast one of the PCIVs in the associated penetration flowpath can receive an isolation signal from the givenFunction. For all Functions except l.c, l.e, 2.c, 3.a, 3.b,3.e, 4.a, 4.b, 4.e, 5.a, 5.b, and 6.a, this would requireboth trip systems to have one channel OPERABLE or in trip.For Function l.c, this would require both trip systems tohave one channel, associated with each MSL, OPERABLE or intrip. For Functions l.e, 3.e and 4.e, each Functionconsists of channels that monitor several locations within agiven area (e.g., different locations within the TurbineBuilding main steam tunnel area). Therefore, this wouldrequire both trip systems to have one channel per locationOPERABLE or in trip. For Functions 2.c, 3.a, 3.b, 4.a, 4.b,5.a, and 6.a, this would require one trip system to have onechannel OPERABLE or in trip.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. The1 hour Completion Time is acceptable because it minimizesrisk while allowing time for restoration or tripping ofchannels.

(continued)

0PBAPS UNIT 2 B 3. 3-161 Revision No. 48


BASES


Entry into Condition B and Required Action B.1 may benecessary to avoid an MSL isolation transient resultingfrom a temporary loss of ventilation in the main steamline tunnel area. As allowed by LCO 3.0.2 (and discussedin the Bases of LCO 3.0.2), the plant may intentionallyenter this Condition to avoid an MSL isolation transientfollowing the loss of ventilation flow, and then raise thesetpoints for the Main Steam Tunnel Temperature-HighFunction to 250'F causing all channels of Main SteamTunnel Temperature-High Function to be inoperable.However, during the period that multiple Main Steam TunnelTemperature-High Function channels are inoperable due tothis intentional action, an additional compensatorymeasure is deemed necessary and shall be taken: anoperator shall observe control room indications of theduct temperature so the main steam line isolation valvesmay be promptly closed in the event of a rapid increase inMSL tunnel temperature indicative of a steam line break.

C.1

Required Action C.1 directs entry into the appropriateCondition referenced in Table 3.3.6.1-1. The applicableCondition specified in Table 3.3.6.1-1 is Function and MODEor other specified condition dependent and may change as theRequired Action of a previous Condition is completed. Eachtime an inoperable channel has not met any Required Actionof Condition A or B and the associated Completion Time hasexpired, Condition C will be entered for that channel andprovides for transfer to the appropriate subsequentCondition.

D.1, D.2.1, and 0.2.2

If the channel is not restored to OPERABLE status or placedin trip within the allowed Completion Time, the plant mustbe placed in a MODE or other specified condition in whichthe LCO does not apply. This is done by placing the plantin at least MODE 3 within 12 hours and in MODE 4 within36 hours (Required Actions D.2.1 and D.2.2). Alternately,the associated MSLs may be isolated (Required Action D.1),

(continued)



BASES

ACTIONS D.I. D.2.1, and D.2.2 (continued)

and, if allowed (i.e., plant safety analysis allowsoperation with an MSL isolated), operation with that MSLisolated may continue. Isolating the affected MSLaccomplishes the safety function of the inoperable channel.The Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.

E.1

If the channel is not restored to OPERABLE status or placedin trip within the allowed Completion Time, the plant mustbe placed in a MODE or other specified condition in whichthe LCO does not apply. This is done by placing the plantin at least MODE 2 within 6 hours.

The allowed Completion Time of 6 hours is reasonable, basedon operating experience, to reach MODE 2 from full powerconditions in an orderly manner and without challengingplant systems.

F.1

If the channel is not restored to OPERABLE status or placedin trip within the allowed Completion Time, plant operationsmay continue if the affected penetration flow path(s) isisolated. Isolating the affected penetration flow path(s)accomplishes the safety function of the inoperable channels.Alternately, if it is not desired to isolate the affectedpenetration flow path(s) (e.g., as in the case whereisolating the penetration flow path(s) could result in areactor scram), Condition G must be entered and its RequiredActions taken. The I hour Completion Time is acceptablebecause it minimizes risk while allowing sufficient time forplant operations personnel to isolate the affectedpenetration flow path(s).

(continued)



BASES

ACTIONS G.] and G.2(continued)

If the channel is not restored to OPERABLE status or placedin trip within the allowed Completion Time, or the RequiredAction of Condition F is not met and the associatedCompletion Time has expired, the plant must be placed in aMODE or other specified condition in which the LCO does notapply. This is done by placing the plant in at least MODE 3within 12 hours and in MODE 4 within 36 hours. The allowedCompletion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.

H.] and H.2

If the channel is not restored to OPERABLE status or placedin trip within the allowed Completion Time, the associatedSLC subsystem(s) is declared inoperable or the RWCU Systemis isolated. Since this Function is required to ensure thatthe SLC System performs its intended function, sufficientremedial measures are provided by declaring the associatedSLC subsystems inoperable or isolating the RWCU System.

The I hour Completion Time is acceptable because itminimizes risk while allowing sufficient time for personnelto isolate the RWCU System.

1.1 and 1.2

If the channel is not restored to OPERABLE status or placedin trip within the allowed Completion Time, the associatedpenetration flow path should be closed. However, if theshutdown cooling function is needed to provide core cooling,these Required Actions allow the penetration flow path toremain unisolated provided action is immediately initiatedto restore the channel to OPERABLE status or to isolate theRHR Shutdown Cooling System (i.e., provide alternate decayheat removal capabilities so the penetration flow path canbe isolated). Actions must continue until the channel isrestored to OPERABLE status or the RHR Shutdown CoolingSystem is isolated.

(continued)



BASES (continued)

SURVEILLANCE As noted at the beginning of the SRs, the SRs for eachREQUIREMENTS Primary Containment Isolation instrumentation Function are

found in the SRs column of Table 3.3.6.1-1.

The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may be delayed for up to6 hours provided the associated Function maintains tripcapability. Upon completion of the Surveillance, orexpiration of the 6 hour allowance, the channel must bereturned to OPERABLE status or the applicable Conditionentered and Required Actions taken. This Note is based onthe reliability analysis (Refs. 6 and 7) assumption of theaverage time required to perform channel surveillance. Thatanalysis demonstrated that the 6 hour testing allowance doesnot significantly reduce the probability that the PCIVs willisolate the penetration flow path(s) when necessary.

SR 3.3.6.1.1

Performance of the CHANNEL CHECK once every 12 hours ensuresthat a gross failure of instrumentation has not occurred. A •CHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween the instrument channels could be an indication ofexcessive instrument drift in one of the channels or ofsomething even more serious. A CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION.


The Frequency is based on operating experience thatdemonstrates channel failure is rare. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannels during normal operational use of the displaysassociated with the channels required by the LCO.

(continued) A



BASES

SURVEILLANCE

REQUIREMENTS

(continued)

SR 3.3.6.1.2

A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function. Any setpoint adjustment shall beconsistent with the assumptions of the current plantspecific setpoint methodology. For Function 1.e, 1.f, 3.e,and 4.e channels, verification that trip settings are lessthan or equal to the specified Allowable Value during theCHANNEL FUNCTIONAL TEST is not required since the installedindication instrumentation does not provide accurateindication of the trip setting. This is consideredacceptable since the magnitude of drift assumed in thesetpoint calculation is based on a 24 month calibrationinterval.

The 92 day Frequency of SR 3.3.6.1.2 is based on thereliability analysis described in Reference 7.

SR 3.3.6.1.3, SR 3.3.6.1.4, SR 3.3.6.1.5, andSR 3.3.6.1.6

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the assumptions of the currentsetpoint methodology. SR 3.3.6.1.6, however, is only acalibration of the radiation detectors using a standardradiation source.

As noted for SR 3.3.6.1.3, the main steam line radiationdetectors (Function l.d) are excluded from CHANNELCALIBRATION due to ALARA reasons (when the plant isoperating, the radiation detectors are generally in a highradiation area; the steam tunnel). This exclusion isacceptable because the radiation detectors are passivedevices, with minimal drift. The radiation detectors arecalibrated in accordance with SR 3.3.6.1.6 on a 24 monthFrequency.

(continued)

PBAPS UNIT 2 B 3. 3-166 Revision No. 48


BASES

SURVEILLANCE SR 3.3.6.1.3. SR 3.3.6.1.4. SR 3.3.6.1.5. andREQUIREMENTS SR 3.3.6.1.6 (continued)

The 92 day Frequency of SR 3.3.6.1.3 is conservative withrespect to the magnitude of equipment drift assumed in thesetpoint analysis. The Frequency of SR 3.3.6.1.4 is basedon the assumption of an 18 month calibration interval in thedetermination of the magnitude of equipment drift in thesetpoint analysis. The Frequencies of SR 3.3.6.1.5 and SR3.3.6.1.6 are based on the assumption of a 24 monthcalibration interval in the determination of the magnitudeof equipment drift in the setpoint analysis.

SR 3.3.6.1.7

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required isolation logic for a specificchannel. The system functional testing performed on PCIVsin LCO 3.6.1.3 overlaps this Surveillance to providecomplete testing of the assumed safety function.

While this Surveillance can be performed with the reactor atpower for some of the Functions, operating experience hasshown these components will pass the Surveillance whenperformed at the 24 month Frequency. Therefore, theFrequency was found to be acceptable from a reliabilitystandpoint.


2. NRC Safety Evaluation Report for Amendment Numbers 156and 158 to Facility Operating License Numbers DPR-44and DPR-56, Peach Bottom Atomic Power Station, UnitNos. 2 and 3, September 7, 1990.


4. NEDO-31466, "Technical Specification ScreeningCriteria Application and Risk Assessment,"November 1987.


(continued)



BASES

6. NEDC-31677P-A, "Technical Specification ImprovementAnalysis for BWR Isolation Actuation Instrumentation,"July 1990.

7. NEDC-30851P-A Supplement 2, "Technical SpecificationsImprovement Analysis for BWR Isolation InstrumentationCommon to RPS and ECCS Instrumentation," March 1989.

PBAPS UNIT 2 B 3.3-168 Revision No. I

Secondary Containment Isolation InstrumentationB 3.3.6.2


B 3.3.6.2 Secondary Containment Isolation Instrumentation

BASES

BACKGROUND The secondary containment isolation instrumentationautomatically initiates closure of appropriate secondarycontainment isolation valves (SCIVs) and starts the StandbyGas Treatment (SGT) System. The function of these systems,in combination with other accident mitigation systems, is tolimit fission product release during and followingpostulated Design Basis Accidents (DBAs) (Ref. 1).Secondary containment isolation and establishment of vacuumwith the SGT System within the required time limits ensuresthat fission products that leak from primary containmentfollowing a DBA, or are released outside primarycontainment, or are released during certain operations whenprimary containment is not required to be OPERABLE aremaintained within applicable limits.

The isolation instrumentation includes the sensors, relays,and switches that are necessary to cause initiation ofsecondary containment isolation. Most channels includeelectronic equipment (e.g., trip units) that comparesmeasured input signals with pre-established setpoints. Whenthe setpoint is exceeded, the channel output relay actuates,which then outputs a secondary containment isolation signalto the isolation logic. Functional diversity is provided bymonitoring a wide range of independent parameters. Theinput parameters to the isolation logic are (1) reactorvessel water level, (2) drywell pressure, (3) reactorbuilding ventilation exhaust high radiation, and(4) refueling floor ventilation exhaust high radiation.Redundant sensor input signals from each parameter areprovided for initiation of isolation.

The outputs of the channels are arranged in a one-out-of-twotaken twice logic. Automatic isolation valves (dampers)isolate and SGT subsystems start when both trip systems arein trip. Operation of both trip systems is required toisolate the secondary containment and provide for thenecessary filtration of fission products.

(continued)



BASES

APPLICABLE errors, as well as, instrument drift. In selected cases,SAFETY ANALYSES, the Allowable Values and trip setpoints are determined byLCO, and engineering judgement or historically accepted practiceAPPLICABILITY relative to the intended function of the channel. The

(continued) trip setpoints determined in this manner provide adequateprotection by assuring instrument and process uncertaintiesexpected for the environments during the operating time ofthe associated channels are accounted for.

In general, the individual Functions are required to beOPERABLE in the MODES or other specified conditions whenSCIVs and the SGT System are required.


1. Reactor Vessel Water Level-Low (Level 3)

Low reactor pressure vessel (RPV) water level indicates thatthe capability to cool the fuel may be threatened. ShouldRPV water level decrease too far, fuel damage could result.An isolation of the secondary containment and actuation ofthe SGT System are initiated in order to minimize thepotential of an offsite dose release. The Reactor VesselWater Level -Low (Level 3) Function is one of the Functionsassumed to be OPERABLE and capable of providing isolationand initiation signals. The isolation and initiationsystems on Reactor Vessel Water Level- Low (Level 3) supportactions to ensure that any offsite releases are within thelimits calculated in the safety analysis.

Reactor Vessel Water Level -Low (Level 3) signals areinitiated from level transmitters that sense the differencebetween the pressure due to a constant column of water(reference leg) and the pressure due to the actual waterlevel (variable leg) in the vessel. Four channels ofReactor Vessel Water Level-Low (Level 3) Function areavailable and are required to be OPERABLE in MODES 1, 2, and3 to ensure that no single instrument failure can precludethe isolation function.

(continued)



BASES (continued)

APPLICABLE The isolation signals generated by the secondary containmentSAFETY ANALYSES, isolation instrumentation are implicitly assumed in theLCO, and safety analyses of References I and 2 to initiate closureAPPLICABILITY of valves and start the SGT System to limit offsite doses.

Refer to LCO 3.6.4.2, "Secondary Containment IsolationValves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment(SGT) System," Applicable Safety Analyses Bases for moredetail of the safety analyses.

The secondary containment isolation instrumentationsatisfies Criterion 3 of the NRC Policy Statement. Certaininstrumentation Functions are retained for other reasons andare described below in the individual Functions discussion.

The OPERABILITY of the secondary containment isolationinstrumentation is dependent on the OPERABILITY of theindividual instrumentation channel Functions. Each Functionmust have the required number of OPERABLE channels withtheir setpoints set within the specified Allowable Values,as shown in Table 3.3.6.2-1. The actual setpoint iscalibrated consistent with applicable setpoint methodologyassumptions. A channel is inoperable if its actual tripsetting is not within its required Allowable Value.

Allowable Values are specified for each Function specifiedin the Table. Trip setpoints are specified in the setpointcalculations. The trip setpoints are selected to ensurethat the setpoints do not exceed the Allowable Value betweenCHANNEL CALIBRATIONS. Operation with a trip setting lessconservative than the trip setpoint, but within itsAllowable Value, is acceptable.

Trip setpoints are those predetermined values of output atwhich an action should take place. The setpoints arecompared to the actual process parameter (e.g., reactorvessel water level), and when the measured output value ofthe process parameter exceeds the setpoint, the associateddevice (e.g., trip unit) changes state. The analytic ordesign limits are derived from the limiting values of theprocess parameters obtained from the safety analysis orother appropriate documents. The Allowable Values arederived from the analytic or design limits, corrected forcalibration, process, and instrument errors. The tripsetpoints are then determined from analytical or designlimits, corrected for calibration, process, and instrument

(continued)



BASES

APPLICABLE 1. Reactor Vessel Water Level-Low (Level 3) (continued)SAFETY ANALYSES,LCO, and The Reactor Vessel Water Level-Low (Level 3) AllowableAPPLICABILITY Value was chosen to be the same as the RPS Level 3 scram

Allowable Value (LCO 3.3.1.1), since isolation of thesevalves and SGT System start are not critical to orderlyplant shutdown.

The Reactor Vessel Water Level-Low (Level 3) Function isrequired to be OPERABLE in MODES 1, 2, and 3 whereconsiderable energy exists in the Reactor Coolant System(RCS); thus, there is a probability of pipe breaks resultingin significant releases of radioactive steam and gas. InMODES 4 and 5, the probability and consequences of theseevents are low due to the RCS pressure and temperaturelimitations of these MODES; thus, this Function is notrequired. In addition, the Function is also required to beOPERABLE during operations with a potential for draining thereactor vessel (OPDRVs) because the capability of isolatingpotential sources of leakage must be provided to ensure thatoffsite dose limits are not exceeded if core damage occurs.

2. Drywell Pressure-High

High drywell pressure can indicate a break in the reactorcoolant pressure boundary (RCPB). An isolation of thesecondary containment and actuation of the SGT System areinitiated in order to minimize the potential of an offsitedose release. The isolation on high drywell pressuresupports actions to ensure that any offsite releases arewithin the limits calculated in the safety analysis. TheDrywell Pressure-High Function associated with isolation isnot assumed in any UFSAR accident or transient analyses butwill provide an isolation and initiation signal. It isretained for the overall redundancy and diversity of thesecondary containment isolation instrumentation as requiredby the NRC approved licensing basis.

(continued)



BASES

APPLICABLE 2. Drywell Pressure-High (continued)SAFETY ANALYSES,LCO, and High drywell pressure signals are initiated from pressureAPPLICABILITY transmitters that sense the pressure in the drywell. Four

channels of Drywell Pressure-High Functions are availableand are required to be OPERABLE to ensure that no singleinstrument failure can preclude performance of the isolationfunction.

The Allowable Value was chosen to be the same as the ECCSDrywell Pressure-High Function Allowable Value(LCO 3.3.5.1) since this is indicative of a loss of coolantaccident (LOCA).

The Drywell Pressure-High Function is required to beOPERABLE in MODES 1, 2, and 3 where considerable energyexists in the RCS; thus, there is a probability of pipebreaks resulting in significant releases of radioactivesteam and gas. This Function is not required in MODES 4and 5 because the probability and consequences of theseevents are low due to the RCS pressure and temperaturelimitations of these MODES.

3., 4. Reactor Building Ventilation and Refueling FloorVentilation Exhaust Radiation-High

High secondary containment exhaust radiation is anindication of possible gross failure of the fuel cladding.The release may have originated from the primary containmentdue to a break in the RCPB or during refueling due to a fuelhandling accident. When Ventilation Exhaust Radiation-Highis detected, secondary containment isolation and actuationof the SGT System are initiated to limit the release offission products as assumed in the UFSAR safety analyses(Ref. 4).

The Ventilation Exhaust Radiation-High signals areinitiated from radiation detectors that are located on theventilation exhaust piping coming from the reactor buildingand the refueling floor zones, respectively. The signalfrom each detector is input to an individual monitor whosetrip outputs are assigned to an isolation channel. Four

(continued)



BASES

APPLICABLE 3. 4. Reactor Building Ventilation and Refueling FloorSAFETY ANALYSES, Ventilation Exhaust Radiation-High (continued)LCO, andAPPLICABILITY channels of Reactor Building Ventilation Exhaust

Radiation-High Function and four channels of RefuelingFloor Ventilation Exhaust Radiation-High Function areavailable and are required to be OPERABLE to ensure that nosingle instrument failure can preclude the isolationfunction.

The Allowable Values are chosen to promptly detect grossfailure of the fuel cladding.

The Reactor Building Ventilation and Refueling FloorVentilation Exhaust Radiation-High Functions are requiredto be OPERABLE in MODES 1, 2, and 3 where considerableenergy exists; thus, there is a probability of pipe breaksresulting in significant releases of radioactive steam andgas. In MODES 4 and 5, the probability and consequences ofthese events are low due to the RCS pressure and temperaturelimitations of these MODES; thus, these Functions are notrequired. In addition, the Functions are also required tobe OPERABLE during CORE ALTERATIONS, OPDRVs, and movement ofirradiated fuel assemblies in the secondary containment,because the capability of detecting radiation releases dueto fuel failures (due to fuel uncovery or dropped fuelassemblies) must be provided to ensure that offsite doselimits are not exceeded.

ACTIONS A Note has been provided to modify the ACTIONS related tosecondary containment isolation instrumentation channels.Section 1.3, Completion Times, specifies that once aCondition has been entered, subsequent divisions,subsystems, components, or variables expressed in theCondition, discovered to be inoperable or not within limits,will not result in separate entry into the Condition.Section 1.3 also specifies that Required Actions of theCondition continue to apply for each additional failure,with Completion Times based on initial entry into theCondition. However, the Required Actions for inoperablesecondary containment isolation instrumentation channelsprovide appropriate compensatory measures for separateinoperable channels. As such, a Note has been provided thatallows separate Condition entry for each inoperablesecondary containment isolation instrumentation channel.

(continued)



BASES


Because of the diversity of sensors available to provideisolation signals and the redundancy of the isolationdesign, an allowable out of service time of 12 hours forFunctions 1 and 2, and 24 hours for Functions other thanFunctions 1 and 2, has been shown to be acceptable (Refs. 5and 6) to permit restoration of any inoperable channel toOPERABLE status. This out of service time is onlyacceptable provided the associated Function is stillmaintaining isolation capability (refer to RequiredAction B.1 Bases). If the inoperable channel cannot berestored to OPERABLE status within the allowable out ofservice time, the channel must be placed in the trippedcondition per Required Action A.1. Placing the inoperablechannel in trip would conservatively compensate for theinoperability, restore capability to accommodate a singlefailure, and allow operation to continue. Alternately, ifit is not desired to place the channel in trip (e.g., as inthe case where placing the inoperable channel in trip wouldresult in an isolation), Condition C must be entered and itsRequired Actions taken.

B.1

Required Action B.1 is intended to ensure that appropriateactions are taken if multiple, inoperable, untrippedchannels within the same Function result in a complete lossof isolation capability for the associated penetration flowpath(s) or a complete loss of automatic initiationcapability for the SGT System. A Function is considered tobe maintaining secondary containment isolation capabilitywhen sufficient channels are OPERABLE or in trip, such thatboth trip systems will generate a trip signal from the givenFunction on a valid signal. This ensures that at least oneof the two SCIVs in the associated penetration flow path andat least one SGT subsystem can be initiated on an isolationsignal from the given Function. For Functions 1, 2, 3,and 4, this would require both trip systems to have onechannel OPERABLE or in trip.

(continued)



BASES


The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. TheI hour Completion Time is acceptable because it minimizesrisk while allowing time for restoration or tripping ofchannels.

C.I.I. C.1.2, C.2.1. and C.2.2

If any Required Action and associated Completion Time ofCondition A or B are not met, the ability to isolate thesecondary containment and start the SGT System cannot beensured. Therefore, further actions must be performed toensure the ability to maintain the secondary containmentfunction. Isolating the associated secondary containmentpenetration flow path(s) and starting the associated SGTsubsystem (Required Actions C.1.1 and C.2.1) performs theintended function of the instrumentation and allowsoperation to continue.

Alternately, declaring the associated SCIVs or SGTsubsystem(s) inoperable (Required Actions C.1.2 and C.2.2)is also acceptable since the Required Actions of therespective LCOs (LCO 3.6.4.2 and LCO 3.6.4.3) provideappropriate actions for the inoperable components.

One hour is sufficient for plant operations personnel toestablish required plant conditions or to declare theassociated components inoperable without unnecessarilychallenging plant systems.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for eachREQUIREMENTS Secondary Containment Isolation instrumentation Function are

located in the SRs column of Table 3.3.6.2-1.

(continued)



BASES


(continued)

The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may 'be delayed for up to6 hours provided the associated Function maintains secondarycontainment isolation capability. Upon completion of theSurveillance, or expiration of the 6 hour allowance, thechannel must be returned to OPERABLE status or theapplicable Condition entered and Required Actions taken.This Note is based on the reliability analysis (Refs. 5and 6) assumption that of the average time required toperform channel surveillance. That analysis demonstratedthe 6 hour testing allowance does not significantly reducethe probability that the SCIVs will isolate the associatedpenetration flow paths and that the SGT System will initiatewhen necessary.

SR 3.3.6.2.1

Performance of the CHANNEL CHECK once every 12 hours ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween the instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION.


The Frequency is based on operating experience thatdemonstrates channel failure is rare. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannel status during normal operational use of the displaysassociated with channels required by the LCO.

(continued) A



BASES


(continued) A CHANNEL FUNCTIONAL TEST is performed on each requiredchannel to ensure that the entire channel will perform theintended function. Any setpoint adjustment shall beconsistent with the assumptions of the current plantspecific setpoint methodology. The Frequency of 92 days forSR 3.3.6.2.2 is based on the reliability analysis ofReferences 5 and 6.

SR 3.3.6.2.3 and SR 3.3.6.2.4T

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the current plant specificsetpoint methodology.

The Frequencies of SR 3.3.6.2.3 and SR 3.3.6.2.4 are basedon the assumption of the magnitude of equipment drift in thesetpoint analysis.

SR 3.3.6.2.5

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required isolation logic for a specificchannel. The system functional testing performed on SCIVsand the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3,respectively, overlaps this Surveillance to provide completetesting of the assumed safety function.


(continued)



BASES (continued)




4. UFSAR, Sections 14.6.3 and 14.6.4.

5. NEDC-31677P-A, "Technical Specification ImprovementAnalysis for BWR Isolation Actuation Instrumentation,"July 1990.

6. NEDC-30851P-A Supplement 2, "Technical SpecificationsImprovement Analysis for BWR Isolation InstrumentationCommon to RPS and ECCS Instrumentation," March 1989.


MCREV System InstrumentationB 3.3.7.1


B 3.3.7.1 Main Control Room Emergency Ventilation (MCREV) SystemInstrumentation

BASES

BACKGROUND The MCREV System is designed to provide a radiologicallycontrolled environment to ensure the habitability of thecontrol room for the safety of control room operators underall plant conditions. Two independent MCREV subsystems areeach capable of fulfilling the stated safety function. Theinstrumentation and controls for the MCREV Systemautomatically initiate action to pressurize the main controlroom (MCR) to minimize the consequences of radioactivematerial in the control room environment.

In the event of a Control Room Air Intake Radiation-Highsignal, the MCREV System is automatically started in thepressurization mode. The outside air from the normalventilation intake is then passed through one of thecharcoal filter subsystems. Sufficient outside air is drawnin through the normal ventilation intake to maintain the MCRslightly pressurized with respect to the turbine building.

The MCREV System instrumentation has two trip systems withtwo Control Room Air Intake Radiation-High channels in eachtrip system. The outputs of the Control Room Air IntakeRadiation-High channels are arranged in two trip systems,which use a one-out-of-two logic. The tripping of both tripsystems will initiate both MCREV subsystems. The channelsinclude electronic equipment (e.g., trip units) thatcompares measured input signals with pre-establishedsetpoints. When the setpoint is exceeded, the channeloutput relay actuates, which then outputs a MCREV Systeminitiation signal to the initiation logic.

APPLICABLE The ability of the MCREV System to maintain the habitabilitySAFETY ANALYSES, of the MCR is explicitly assumed for certain accidents asLCO, and discussed in the UFSAR safety analyses (Refs. 1, 2, and 3).APPLICABILITY MCREV System operation ensures that the radiation exposure

of control room personnel, through the duration of any oneof the postulated accidents, does not exceed acceptablelimits.

(continued)



BASES


(continued)

MCREV System instrumentation satisfies Criterion 3 of theNRC Policy Statement.

The OPERABILITY of the MCREV System instrumentation isdependent upon the OPERABILITY of the Control Room AirIntake Radiation -High instrumentation channel Function.The Function must have a required number of OPERABLEchannels, with their setpoints within the specifiedAllowable Values, where appropriate. A channel isinoperable if its actual trip setting is not within itsrequired Allowable Value. The actual setpoint is calibratedconsistent with applicable setpoint methodology assumptions.

Allowable Values are specified for the MCREV System ControlRoom Air Intake Radiation-High Function. Trip setpointsare specified in the setpoint calculations. The tripsetpoints are selected to ensure that the setpoints do notexceed the Allowable Value between successive CHANNELCALIBRATIONS. Operation with a trip setting lessconservative than the trip setpoint, but within itsAllowable Value, is acceptable. Trip setpoints are thosepredetermined values of output at which an action shouldtake place. The setpoints are compared to the actualprocess parameter (e.g., control room air intake radiation),and when the measured output value of the process parameterexceeds the setpoint, the associated device changes state.The analytic limits are derived from the limiting values ofthe process parameters obtained from the safety analysis.The Allowable Values are derived from the analytic limits,corrected for calibration, process, and instrument errors.The trip setpoints are determined from analytical or designlimits, corrected for calibration, process, and instrumenterrors, as well as, instrument drift. The trip setpointsderived in this manner provide adequate protection byensuring instrument and process uncertainties expected forthe environments during the operating time of the associatedchannels are accounted for.

The, control room air intake radiation monitors measureradiation levels in the fresh air supply plenum. A highradiation level may pose a threat to MCR personnel; thus,automatically initiating the MCREV System.

(continued)



BASES

APPLICABLE The Control Room Air Intake Radiation-High FunctionSAFETY ANALYSES, consists of four independent monitors. Two channels ofLCO, and Control Room Air Intake Radiation-High per trip system areAPPLICABILITY available and are required to be OPERABLE to ensure that no

(continued) single instrument failure can preclude MCREV Systeminitiation. The Allowable Value was selected to ensureprotection of the control room personnel.

The Control Room Air Intake Radiation-High Function isrequired to be OPERABLE in MODES 1, 2, and 3 and during COREALTERATIONS, OPDRVs, and movement of irradiated fuelassemblies in the secondary containment, to ensure thatcontrol room personnel are protected during a LOCA, fuelhandling event, or vessel draindown event. During MODES 4and 5, when these specified conditions are not in progress(e.g., CORE ALTERATIONS), the probability of a LOCA or fueldamage is low; thus, the Function is not required.

ACTIONS A Note has been provided to modify the ACTIONS related toMCREV System instrumentation channels. Section 1.3,Completion Times, specifies that once a Condition has beenentered, subsequent divisions, subsystems, components, orvariables expressed in the Condition, discovered to beinoperable or not within limits, will not result in separateentry into the Condition. Section 1.3 also specifies thatRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable MCREV System instrumentation channels provideappropriate compensatory measures for separate inoperablechannels. As such, a Note has been provided that allowsseparate Condition entry for each inoperable MCREV Systeminstrumentation channel.

A.1 and A.2

Because of the redundancy of sensors available to provideinitiation signals and the redundancy of the MCREV Systemdesign, an allowable out of service time of 6 hours has beenshown to be acceptable (Ref. 4), to permit restoration ofany inoperable channel to OPERABLE status. However, thisout of service time is only acceptable provided the ControlRoom Air Intake Radiation-High Function is stillmaintaining MCREV System initiation capability. TheFunction is considered to be maintaining MCREV System

(continued)



BASES


initiation capability when sufficient channels are OPERABLEor in trip such that the two trip systems will generate aninitiation signal from the given Function on a valid signal.For the Control Room Air Intake Radiation-High Function,this would require the two trip systems to have one channelper trip system OPERABLE or in trip. In this situation(loss of MCREV System initiation capability), the 6 hourallowance of Required Action A.2 is not appropriate. If theFunction is not maintaining MCREV System initiationcapability, the MCREV System must be declared inoperablewithin I hour of discovery of the loss of MCREV Systeminitiation capability in both trip systems.

The 1 hour Completion Time (A.1) is acceptable because itminimizes risk while allowing time for restoring or trippingof channels.

If the inoperable channel cannot be restored to OPERABLEstatus within the allowable out of service time, the channelmust be placed in the tripped condition per RequiredAction A.2. Placing the inoperable channel in trip wouldconservatively compensate for the inoperability, restorecapability to accommodate a single failure, and allowoperation to continue. Alternately, if it is not desired toplace the channel in trip (e.g., as in the case whereplacing the inoperable channel in trip would result in aninitiation), Condition B must be entered and its RequiredAction taken.

B.1 and B.2

With any Required Action and associated Completion Time notmet, the associated MCREV subsystem(s) must be placed inoperation per Required Action B.1 to ensure that controlroom personnel will be protected in the event of a DesignBasis Accident. The method used to place the MCREVsubsystem(s) in operation must provide for automaticallyre-initiating the subsystem(s) upon restoration of powerfollowing a loss of power to the MCREV subsystem(s).Alternately, if it is not desired to start the subsystem(s),the MCREV subsystem(s) associated with inoperable, untripped

(continued)



BASES

ACTIONS B.I and B.2 (continued)

channels must be declared inoperable within 1 hour. Sinceeach trip system can affect both MCREV subsystems, RequiredActions B.1 and B.2 can be performed independently on eachMCREV subsystem. That is, one MCREV subsystem can be placedin operation (Required Action B.1) while the other MCREVsubsystem can be declared inoperable (Required Action B.2).

The 1 hour Completion Time is intended to allow the operatortime to place the MCREV subsystem(s) in operation. The1 hour Completion Time is acceptable because it minimizesrisk while allowing time for placing the associated MCREVsubsystem(s) in operation, or for entering the applicableConditions and Required Actions for the inoperable MCREVsubsystem(s).


The Surveillances are modified by a Note to indicate thatwhen a channel is placed in an inoperable status solely forperformance of required Surveillances, entry into associatedConditions and Required Actions may be delayed for up to6 hours, provided the associated Function maintains MCREVSystem initiation capability. Upon completion of theSurveillance, or expiration of the 6 hour allowance, thechannel must be returned to OPERABLE status or theapplicable Condition entered and Required Actions taken.This Note is based on the reliability analysis (Ref. 4)assumption of the average time required to perform channelsurveillance. That analysis demonstrated that the 6 hourtesting allowance does not significantly reduce theprobability that the MCREV System will initiate whennecessary.

SR 3.3.7.1.1

Performance of the CHANNEL CHECK once every 12 hours ensuresthat a gross failure of instrumentation has not occurred. ACHANNEL CHECK is normally a comparison of the parameterindicated on one channel to a similar parameter on otherchannels. It is based on the assumption that instrumentchannels monitoring the same parameter should readapproximately the same value. Significant deviationsbetween the instrument channels could be an indication ofexcessive instrument drift in one of the channels orsomething even more serious. A CHANNEL CHECK will detect

(continued)



BASES


gross channel failure; thus, it is key to verifying theinstrumentation continues to operate properly between eachCHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, basedon a combination of the channel instrument uncertainties,including indication and readability. If a channel isoutside the criteria, it may be an indication that theinstrument has drifted outside its limit.

The Frequency is based upon operating experience thatdemonstrates channel failure is rare. The CHANNEL CHECKsupplements less formal, but more frequent, checks ofchannel status during normal operational use of the displaysassociated with channels required by the LCO.

SR 3.3.7.1.2


The Frequency of 92 days is based on the reliabilityanalyses of Reference 4.

SR 3.3.7.1.3

A CHANNEL CALIBRATION is a complete check of the instrumentloop and the sensor. This test verifies the channelresponds to the measured parameter within the necessaryrange and accuracy. CHANNEL CALIBRATION leaves the channeladjusted to account for instrument drifts between successivecalibrations, consistent with the assumptions of the plantspecific setpoint methodology.

The Frequency is based upon the assumption of an 18 monthcalibration interval in the determination of the magnitudeof the equipment drift in the setpoint analysis.

(continued)



BASES


(continued)

SR 3.3.7.1.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required initiation logic for a specificchannel. The system functional testing performed inLCO 3.7.4, "Main Control Room Emergency Ventilation (MCREV)System," overlaps this Surveillance to provide completetesting of the assumed safety function.

While this Surveillance can be performed with the reactor atpower, operating experience has shown these components willpass the Surveillance when performed at the 24 monthFrequency. Therefore, the Frequency was found to beacceptable from a reliability standpoint.




4. GENE-770-06-1, "Bases for Changes to Surveillance TestIntervals and Allowed Out-of-Service Times forSelected Instrumentation Technical Specifications,"February 1991.


LOP InstrumentationB 3.3.8.1


B 3.3.8.1 Loss of Power (LOP) Instrumentation

BASES

BACKGROUND

II

Successful operation of the required safety functions of theEmergency Core Cooling Systems (ECCS) is dependent upon theavailability of adequate power for energizing variouscomponents such as pump motors, motor operated valves, andthe associated control components. The LOP instrumentationmonitors the 4 kV emergency buses voltage. Offsite power isthe preferred source of power for the 4 kV emergency buses.If the LOP instrumentation detects that voltage levels aretoo low, the buses are disconnected from the offsite powersources and connected to the onsite diesel generator (DG)power sources.

Each Unit 2 4 kV emergency bus has its own independent LOPinstrumentation and associated trip logic. The voltage foreach bus is monitored at five levels, which can beconsidered as two different undervoltage Functions: onelevel of loss of voltage and four levels of degradedvoltage. The Functions cause various bus transfers anddisconnects. The degraded voltage Function is monitored byfour undervoltage relays per source and the loss of voltageFunction is monitored by one undervoltage relay for eachemergency bus. The degraded voltage outputs and the loss ofvoltage outputs are arranged in a one-out-of-one trip logicconfiguration. Each channel consists of four protectiverelays that compare offsite source voltages withpre-established setpoints. When the sensed voltage is belowthe setpoint for a degraded voltage channel, the preferredoffsite source breaker to the 4 kV emergency bus is trippedand autotransfer to the alternate offsite source isinitiated. If the alternate source does not provideadequate voltage to the bus as sensed by its degraded gridrelays, a diesel generator start signal is initiated.

A description of the Unit 3 LOP instrumentationin the Bases for Unit 3 LCO 3.3.8.1.

is provided

(continued)



BASES (continued)


The LOP instrumentation is required for Engineered SafetyFeatures to function in any accident with a loss of offsitepower. The required channels of LOP instrumentation ensurethat the ECCS and other assumed systems powered from theDGs, provide plant protection in the event of any of theReference 1 (UFSAR) analyzed accidents in which a loss ofoffsite power is assumed. The first level is loss ofvoltage. This loss of voltage level detects and disconnectsthe Class 1E buses from the offsite power source upon atotal loss of voltage. The second level of undervoltageprotection is provided by the four levels of degraded gridvoltage relays which are set to detect a sustained lowvoltage condition. These degraded grid relays disconnectthe Class iE buses from the offsite power source if thedegraded voltage condition exists for a time interval whichcould prevent the Class IE equipment from achieving itssafety function. The degraded grid relays also prevent theClass IE equipment from sustaining damage from prolongedoperation at reduced voltage. The combination of the lossof voltage relaying and the degraded grid relaying providesprotection to the Class IE distribution system for allcredible conditions of voltage collapse or sustained voltagedegradation. The initiation of the DGs on loss of offsitepower, and subsequent initiation of the ECCS, ensure thatthe fuel peak cladding temperature remains below the limitsof 10 CFR 50.46.

Accident analyses credit the loading of the DG based on theloss of offsite power during a loss of coolant accident.The diesel starting and loading times have been included inthe delay time associated with each safety system componentrequiring DG supplied power following a loss of offsitepower.

The LOP instrumentation satisfies Criterion 3 of the NRCPolicy Statement.

The OPERABILITY of the LOP instrumentation is dependent uponthe OPERABILITY of the individual instrumentation relaychannel Functions specified in Table 3.3.8.1-1. EachFunction must have a required number of OPERABLE channelsper 4 kV emergency bus, with their setpoints within thespecified Allowable Values except the bus undervoltage relaywhich does not have an Allowable Value. A degraded voltagechannel is inoperable if its actual trip setpoint is notwithin its required Allowable Value. Setpoints arecalibrated consistent with the Improved Instrument SetpointControl Program (IISCP) methodology assumptions. (Note:Table 3.3.8.1-1 contains a note that prior to theimplementation of modification 96-01511, the relay voltageand timer trip setpoint Allowable Vaulues for the indicated

(continued)



BASES


(continued)

functions remain at the previously approved values on arelay by relay basis.) The loss of voltage channel isinoperable if it will not start the diesel on a loss ofpower to a 4 kV emergency bus.

The Allowable Values are specified for each applicableFunction in the Table 3.3.8.1-1. The nominal setpoints areselected to ensure that the setpoints do not exceed theAllowable Value between CHANNEL CALIBRATIONS. Operationwith a trip setpoint within the Allowable Value, isacceptable. Trip setpoints are those predetermined valuesof output at which an action should take place. Thesetpoints are compared to the actual process parameter(e.g., voltage), and when the measured output value of theprocess parameter exceeds the setpoint, the protective relayoutput changes state. The Allowable Values were set equalto the limiting values determined by the voltage regulationcalculation. The setpoints were corrected using IISCPmethodology to account for relay drift, relay accuracy,potential transformer accuracy, measuring and test equipmentaccuracy margin, and includes a calibration leave alonezone. IISCP methodology utilizes the square root of the sumof the squares to combine random non-directional accuracyvalues. IISCP then includes relay drift, calibration leavealone zones, and margins. (Note: Table 3.3.8.1-1 contains anote that prior to the implementation of modification 96-01511, the relay voltage and timer trip setpoint AllowableValues for the indicated functions remain at the previouslyapproved values on a relay by relay basis.) The setpointassumes a nominal 35/1 potential transformer ratio.

The specific Applicable Safety Analyses, LCO, andApplicability discussions for Unit 2 LOP instrumentation arelisted below on a Function by Function basis.

In addition, since some equipment required by Unit 2 ispowered from Unit 3 sources, the Unit 3 LOP instrumentationsupporting the required sources must also be OPERABLE. TheOPERABILITY requirements for the Unit 3 LOP instrumentationis the same as described in this section, except Function 4(4 kV Emergency Bus Undervoltage, Degraded Voltage LOCA) isnot required to be OPERABLE, since this Function is relatedto a LOCA on Unit 3 only. The Unit 3 instrumentation islisted in Unit 3 Table 3.3.8.1-1.

1. 4 kV Emergency Bus Undervoltage (Loss of Voltage)

When both offsite sources are lost, a loss of voltagecondition on a 4 kV emergency bus indicates that therespective emergency bus is unable to supply sufficientpower for proper operation of the applicable equipment.Therefore, the power supply to the bus is transferred fromoffsite power to DG power. This ensures that adequate powerwill be available to the required equipment.

(continued)0



BASES

APPLICABLE 1. 4 kV Emergency Bus Undervoltaqe (Loss of Voltage)SAFETY ANALYSIS, (continued)LCO, andAPPLICABILITY The single channel of 4 kV Emergency Bus Undervoltage (Loss

of Voltage) Function per associated emergency bus is onlyrequired to be OPERABLE when the associated DG and offsitecircuit are required to be OPERABLE. This ensures no singleinstrument failure can preclude the start of three of fourDGs. (One channel inputs to each of the four DGs.) Referto LCO 3.8.1, "AC Sources-Operating," and 3.8.2, "ACSources-Shutdown," for Applicability Bases for the DGs.

2., 3., 4.. 5. 4 kV Emergency Bus Undervoltaqe (DegradedVoltage)

A degraded voltage condition on a 4 kV emergency busindicates that, while offsite power may not be completelylost to the respective emergency bus, available power may beinsufficient for starting large ECCS motors without riskingdamage to the motors that could disable the ECCS function.

Therefore, power to the bus is transferred from offsitepower to onsite DG power when there is insufficient offsitepower to the bus. This transfer will occur only if thevoltage of the preferred and alternate power sources dropbelow the Degraded Voltage Function Allowable Values(degraded voltage with a time delay) and the source breakerstrip which causes the bus undervoltage relay to initiate theDG. This ensures that adequate power will be available tothe required equipment.

Four Functions are provided to monitor degraded voltage atfour different levels. These Functions are the DegradedVoltage Non-LOCA, Degraded Voltage LOCA, Degraded VoltageHigh Setting, and Degraded Voltage Low Setting. Theserelays monitor the following voltage levels with thefollowing time delays: the Function 2 relay, 2286 - 2706volts in approximately 2 seconds when source voltage isreduced abruptly to zero volts (inverse time delay); theFunction 3 relay, 3409 - 3829 volts in approximately 30seconds when source voltage is reduced abruptly to 2940volts (inverse time delay); the Function 4 relay, 3766 -3836 volts in approximately 10 seconds; and the Function 5relay, 4116 - 4186 volts in approximately 60 seconds.(Note: Table 3.3.8.1-1 contains a note that prior to theimplementation of modification 96-01511, the relay voltageand timer trip setpoint Allowable Values for the indicatedfunctions remain at the previously approved values on arelay by relay basis.) The Function 2 and 3 relays areinverse time delay relays. These relays operate along arepeatable characteristic curve. With relay operation beinginverse with time, for

(continued)



BASES

APPLICABLE 2., 3.. 4., 5. 4 kV Emergency Bus Undervoltage (DegradedSAFETY ANALYSES, Voltage) (continued)LCO, andAPPLICABILITY an abrupt reduction in voltage the relay operating time will

be short; conversely, for a slight reduction in voltage, theoperating time delay will be long.

The Degraded Voltage LOCA Function preserves the assumptionsof the LOCA analysis and the combined Functions of the otherrelays preserves the assumptions of the accident sequenceanalysis in the UFSAR. The Degraded Voltage Non-LOCAFunction provides assurance that equipment powered from the4kV emergency buses is not damaged by degraded voltage thatmight occur under other than LOCA conditions. This degradedgrid non-LOCA relay has an associated 60 second timer. Thistimer allows for offsite source transformer load tap changeroperation. Degraded voltage conditions can be mitigated bytap changer operations and other manual actions. The 60second timer provides the time for these actions to takeplace.

The degraded grid voltage Allowable Values are low enough toprevent inadvertent power supply transfer, but high enoughto ensure that sufficient power is available to the requiredequipment. The Time Delay Allowable Values are long enoughto provide time for the offsite power supply to recover tonormal voltages, but short enough to ensure that sufficientpower is available to the required equipment.

Two channels (one channel per source) of 4 kV Emergency BusDegraded Voltage (Functions 2, 3, 4, and 5) per associatedbus are required to be OPERABLE when the associated DG andoffsite circuit are required to be OPERABLE. This ensures nosingle instrument failure can preclude the start of three offour DGs (each logic inputs to each of the four DGs). Referto LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for theDGs.

ACTIONS A Note has been provided (Note 1) to modify the ACTIONSrelated to LOP instrumentation channels. Section 1.3,Completion Times, specifies that once a Condition has beenentered, subsequent divisions, subsystems, components, orvariables expressed in the Condition, discovered to beinoperable or not within limits, will not result in separateentry into the Condition. Section 1.3 also specifies thatRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initial

(continued)



BASES

ACTIONS entry into the Condition. However, the Required Actions for(continued) inoperable LOP instrumentation channels provide appropriate

compensatory measures for separate inoperable channels. Assuch, a Note has been provided that allows separateCondition entry for each inoperable LOP instrumentationchannel.

A.1

Pursuant to LCO 3.0.6, the AC Sources -Operating ACTIONSwould not have to be entered even if the LOP instrumentationinoperability resulted in an inoperable offsite circuit.Therefore, the Required Action of Condition A is modified bya Note to indicate that when performance of a RequiredAction results in the inoperability of an offsite circuit,Actions for LCO 3.8.1, "AC Sources-Operating," must beimmediately entered. A Unit 2 offsite circuit is consideredto be inoperable if it is not supplying or not capable ofsupplying (due to loss of autotransfer capability) at leastthree Unit 2 4 kV emergency buses when the other offsitecircuit is providing power or capable of supplying power toall four Unit 2 4 kV emergency buses. A Unit 2 offsitecircuit is also considered to be inoperable if the Unit 24 kV emergency buses being powered or capable of beingpowered from the two offsite circuits are all the same whenat least one of the two circuits does not provide power oris not capable of supplying power to all four Unit 2 4 kVemergency buses. Inoperability of a Unit 3 offsite circuitis the same as described for a Unit 2 offsite circuit,except that the circuit path is to the Unit 3 4 kV emergencybuses required to be OPERABLE by LCO 3.8.7, "DistributionSystems -Operating." The Note allows Condition A to providerequirements for the loss of a LOP instrumentation channelwithout regard to whether an offsite circuit is renderedinoperable. LCO 3.8.1 provides appropriate restriction foran inoperable offsite circuit.

Required Action A.1 is applicable when one 4 kV emergencybus has one or two required Function 3 (Degraded VoltageHigh Setting) channels inoperable or when one 4 kV emergencybus has one or two required Function 5 (Degraded VoltageNon-LOCA) channels inoperable. In this Condition, theaffected Function may not be capable of performing itsintended function automatically for these buses. However,the operators would still receive indication in the controlroom of a degraded voltage condition on the unaffected busesand a manual transfer of the affected bus power supply to

(continued)



BASES


the alternate source could be made without damaging plantequipment. Therefore, Required Action A.1 allows 14 days torestore the inoperable channel(s) to OPERABLE status orplace the inoperable channel(s) in trip. Placing theinoperable channel in trip would conservatively compensatefor the inoperability, restore design trip capability to theLOP instrumentation, and allow operation to continue.Alternatively, if it is not desired to place the channel intrip (e.g., as in the case where placing the channel in tripwould result in DG initiation), Condition D must be enteredand its Required Action taken.

The 14 day Completion Time is intended to allow time torestore the channel(s) to OPERABLE status. The CompletionTime takes into consideration the diversity of the DegradedVoltage Functions, the capabilities of the remainingOPERABLE LOP Instrumentation Functions on the affected 4 kVemergency bus and on the other 4 kV emergency buses (onlyone 4 kV emergency bus is affected by the inoperablechannels),-the fact that the Degraded Voltage High Settingand Degraded Voltage Non-LOCA Functions provide only amarginal increase in the protection provided by the voltagemonitoring scheme, the low probability of the grid operatingin the voltage band protected by these Functions, and theability of the operators to perform the Functions manually.

B.1

Pursuant to LCO 3.0.6, the AC Sources -Operating ACTIONSwould not have to be entered even if the LOP instrumentationinoperability resulted in an inoperable offsite circuit.Therefore, the Required Action of Condition B is modified bya Note to indicate that when performance of a RequiredAction results in the inoperability of an offsite circuit,Actions for LCO 3.8.1, "AC Sources -Operating," must beimmediately entered. A Unit 2 offsite circuit is consideredto be inoperable if it is not supplying or not capable ofsupplying (due to loss of autotransfer capability) at leastthree Unit 2 4 kV emergency buses when the other offsitecircuit is providing power or capable of supplying power toall four Unit 2 4 kV emergency buses. A Unit 2 offsitecircuit is also considered to be inoperable if the Unit 24 kV emergency buses being powered or capable of beingpowered from the two offsite circuits are all the same whenat least one of the two circuits does not provide power or

(continued)



BASES


is not capable of supplying power to all four Unit 2 4 kVemergency buses. Inoperability of a Unit 3 offsite circuitis the same as described for a Unit 2 offsite circuit,except that the circuit path is to the Unit 3 4 kV emergencybuses required to be OPERABLE by LCO 3.8.7, "DistributionSystems - Operating." This allows Condition B to providerequirements for the loss of a LOP instrumentation channelwithout regard to whether an offsite circuit is renderedinoperable. LCO 3.8.1 provides appropriate restriction foran inoperable offsite circuit.

Required Action B.1 is applicable when two 4 kV emergencybuses have one required Function 3 (Degraded Voltage HighSetting) channel inoperable, or when two 4 kV emergencybuses have one required Function 5 (Degraded Voltage Non-LOCA) channel inoperable, or when one 4 kV emergency bus hasone required Function 3 channel inoperable and a different4 kV emergency bus has one required Function 5 channelinoperable. In this Condition, the affected Function maynot be capable of performing its intended functionautomatically for these buses. However, the operators wouldstill receive indication in the control room of a degradedvoltage condition on the unaffected buses and a manualtransfer of the affected bus power supply to the alternatesource could be made without damaging plant equipment.Therefore, Required Action B.1 allows 24 hours to restorethe inoperable channels to OPERABLE status or place theinoperable channels in trip. Placing the inoperable channelin trip would conservatively compensate for theinoperability, restore design trip capability to the LOPinstrumentation, and allow operation to continue.Alternatively, if it is not desired to place the channel intrip (e.g., as in the case where placing the channel in tripwould result in DG initiation), Condition D must be enteredand its Required Action taken.

The 24 hour Completion Time is intended to allow time torestore the channel(s) to OPERABLE status. The CompletionTime takes into consideration the diversity of the DegradedVoltage Functions, the capabilities of the remainingOPERABLE LOP Instrumentation Functions on the affected 4 kVemergency buses and on the other 4 kV emergency buses (onlytwo 4 kV emergency buses are affected by the inoperablechannels), the fact that the Degraded Voltage High Settingand Degraded Voltage Non-LOCA Functions provide only a

(continued)



BASES


marginal increase in the protection provided by the voltagemonitoring scheme, the low probability of the grid operatingin the voltage band protected by these Functions, and theability of the operators to perform the Functions manually.

C.'

Pursuant to LCO 3.0.6, the AC Sources-Operating ACTIONSwould not have to be entered even if the LOP Instrumentationinoperability resulted in an inoperable offsite circuit.Therefore, the Required Action of Condition C is modified bya Note to indicate that when performance of the RequiredAction results in the inoperability of an offsite circuit,Actions for LCO 3.8.1, "AC Sources-Operating," must beimmediately entered. A Unit 2 offsite circuit isconsidered to be inoperable if it is not supplying or notcapable of supplying (due to loss of autotransfercapability) at least three Unit 2 4 kV emergency buses whenthe other offsite circuit is providing power or capable ofsupplying power to all four Unit 2 4 kV emergency buses. AUnit 2 offsite circuit is also considered to be inoperableif the Unit 2 4 kV emergency buses being powered or capableof being powered from the two offsite circuits are all thesame when at least one of the two circuits does not providepower or is not capable of supplying power to all fourUnit 2 4 kV emergency buses. Inoperability of a Unit 3offsite circuit is the same as described for a Unit 2offsite circuit, except that the circuit path is to theUnit 3 4 kV emergency buses required to be OPERABLE byLCO 3.8.7, "Distribution Systems - Operating." The Noteallows Condition C to provide requirements for the loss of aLOP instrumentation channel without regard to whether anoffsite circuit is rendered inoperable. LCO 3.8.1 providesappropriate restriction for an inoperable offsite circuit.

Required Action C.1 is applicable when one or more 4 kVemergency buses have one or more required Function 1, 2, or4 (the Loss of Voltage, the Degraded Voltage Low Setting,and the Degraded Voltage LOCA Functions, respectively)channels inoperable, or when one 4 kV emergency bus has onerequired Function 3 (Degraded Voltage High Setting) channeland one required Function 5 (Degraded Voltage Non-LOCA)channel inoperable, or when any combination of three or morerequired Function 3 and Function 5 channels are inoperable.In this Condition, the affected Function may not be capable

(continued)



BASES

ACTIONS C.1 (continued)

of performing the intended function and the potentialconsequences associated with the inoperable channel(s) aregreater than those resulting from Condition A orCondition B. Therefore, only I hour is allowed to restorethe inoperable channel to OPERABLE status. If theinoperable channel cannot be restored to OPERABLE statuswithin the allowable out of service time, the channel mustbe placed in the tripped condition per Required Action C.I.Placing the inoperable channel in trip would conservativelycompensate for the inoperability, restore design tripcapability to the LOP instrumentation, and allow operationto continue. Alternately, if it is not desired to place thechannel in trip (e.g., as in the case where placing thechannel in trip would result in a DG initiation),Condition D must be entered and its Required Action taken.

The Completion Time is based on the potential consequencesassociated with the inoperable channel(s) and is intended toallow the operator time to evaluate and repair anydiscovered inoperabilities. The I hour Completion Time isacceptable because it minimizes risk while allowing time forrestoration or tripping of channels.

D.1

If any Required Action and associated Completion Time arenot met, the associated Function is not capable ofperforming the intended function. Therefore, the associatedDG(s) is declared inoperable immediately. This requiresentry into applicable Conditions and Required Actions ofLCO 3.8.1 and LCO 3.8.2, which provide appropriate actionsfor the inoperable DG(s).

SURVEILLANCE As noted at the beginning of the SRs, the SRs for eachREQUIREMENTS Unit 2 LOP instrumentation Function are located in the SRs

column of Table 3.3.8.1-1. SR 3.3.8.1.5 is applicable onlyto the Unit 3 LOP instrumentation.

The Surveillance are also modified by a Note to indicatethat when a channel is placed in an inoperable status solelyfor performance of required Surveillance, entry intoassociated Conditions and Required Actions may be delayedfor up to 2 hours provided: (a) for Function 1, theassociated Function maintains initiation capability for

(continued)



BASES


(continued)three DGs; and (b) for Functions 2, 3, 4, 5, the associatedFunction maintains undervoltage transfer capability forthree 4 kV emergency buses. The loss of function for one DGor undervoltage transfer capability for the 4 kV emergencybus for this short period is appropriate since only three offour DGs are required to start within the required times andbecause there is no appreciable impact on risk. Also, uponcompletion of the Surveillance, or expiration of the 2 hourallowance, the channel must be returned to OPERABLE statusor the applicable Condition entered and Required Actionstaken.

SR 3.3.8.1.1 and SR 3.3.8.1.3


The Frequency of 31 days is based on operating experiencewith regard to channel OPERABILITY and drift, whichdemonstrates that failure of more than one degraded voltagechannel of a given Function in any 31 day interval is a rareevent. The Frequency of 24 months is based on operatingexperience with regard to channel OPERABILITY and drift,which demonstrates that failure of the loss of voltagechannel in any 24 month interval is a rare event.

SR 3.3.8.1.2

A CHANNEL CALIBRATION is a complete check of the relaycircuitry and associated time delay relays. This testverifies the channel responds to the measured parameterwithin the necessary range and accuracy. CHANNELCALIBRATION leaves the channel adjusted to account forinstrument drifts between successive calibrations,consistent with the assumptions of the current plantspecific setpoint methodology.

The 18 month Frequency for the degraded voltage Functions isbased upon the assumption of the magnitude of equipmentdrift in the setpoint analysis.

(continued)



BASES


(continued)

SR 3.3.8.1.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates theOPERABILITY of the required actuation logic for a specificchannel. The system functional testing performed inLCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance toprovide complete testing of the assumed safety functions.

The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.

SR 3.3.8.1.5

With the exception of this Surveillance, all otherSurveillances of this Specification (SR 3.3.8.1.1 throughSR 3.3.8.1.4) are applied only to the Unit 2 LOPinstrumentation. This Surveillance is provided to directthat the appropriate Surveillance for the required Unit 3LOP instrumentation are governed by the Unit 3 TechnicalSpecifications. Performance of the applicable Unit 3Surveillances will satisfy Unit 3 requirements, as well assatisfying this Unit 2 Surveillance Requirement.

The Frequency required by the applicable Unit 3 SR alsogoverns performance of that SR for Unit 2.

REFERENCES I. UFSAR, Chapter 14.


RPS Electric Power MonitoringB 3.3.8.2


B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring

BASES

BACKGROUND RPS Electric Power Monitoring System is provided to isolatethe RPS bus from the motor generator (MG) set or analternate power supply in the event of overvoltage,undervoltage, or underfrequency. This system protects theloads connected to the RPS bus against unacceptable voltageand frequency conditions (Ref. 1) and forms an importantpart of the primary success path of the essential safetycircuits. Some of the essential equipment powered from theRPS buses includes the RPS logic and scram solenoids.

RPS electric power monitoring assembly will detect anyabnormal high or low voltage or low frequency condition inthe outputs of the two MG sets or the alternate power supplyand will de-energize its respective RPS bus, thereby causingall safety functions normally powered by this bus tode-energize.

In the event of failure of an RPS Electric Power MonitoringSystem (e.g., both in series electric power monitoringassemblies), the RPS loads may experience significanteffects from the unregulated power supply. Deviation fromthe nominal conditions can potentially cause damage to thescram solenoids and other Class lE devices.

In the event of a low voltage condition, the scram solenoidscan chatter and potentially lose their pneumatic controlcapability, resulting in a loss of primary scram action.

In the event of an overvoltage condition, the RPS logicrelays and scram solenoids may experience a voltage higherthan their design voltage. If the overvoltage conditionpersists for an extended time period, it may cause equipmentdegradation and the loss of plant safety function.

Two redundant Class 1E circuit breakers are connected inseries between each RPS bus and its MG set, and between eachRPS bus and its alternate power supply if in service. Eachof these circuit breakers has an associated independent set

(continued)



BASES


of Class 1E overvoltage, undervoltage, underfrequencyrelays, time delay relays (MG sets only), and sensing logic.Together, a circuit breaker, its associated relays, andsensing logic constitute an electric power monitoringassembly. If the output of the MG set or alternate powersupply exceeds predetermined limits of overvoltage,undervoltage, or underfrequency, a trip coil driven by thislogic circuitry opens the circuit breaker, which removes theassociated power supply from service.


The RPS electric power monitoring is necessary to meet theassumptions of the safety analyses by ensuring that theequipment powered from the RPS buses can perform itsintended function. RPS electric power monitoring providesprotection to the RPS components that receive power from theRPS buses, by acting to disconnect the RPS from the powersupply under specified conditions that could damage the RPSequipment.

RPS electric power monitoring satisfies Criterion 3 of theNRC Policy Statement.

LCO The OPERABILITY of each RPS electric power monitoringassembly is dependent on the OPERABILITY of the overvoltage,undervoltage, and underfrequency logic, as well as theOPERABILITY of the associated circuit breaker. Two electricpower monitoring assemblies are required to be OPERABLE foreach inservice power supply. This provides redundantprotection against any abnormal voltage or frequencyconditions to ensure that no single RPS electric powermonitoring assembly failure can preclude the function of RPScomponents. Each inservice electric power monitoringassembly's trip logic setpoints are required to be withinthe specified Allowable Value. The actual setpoint iscalibrated consistent with applicable setpoint methodologyassumptions.

Allowable Values are specified for each RPS electric powermonitoring assembly trip logic (refer to SR 3.3.8.2.2).Trip setpoints are specified in design documents. The tripsetpoints are selected based on engineering judgement andoperational experience to ensure that the setpoints do notexceed the Allowable Value between CHANNEL CALIBRATIONS.Operation with a trip setting less conservative than thetrip setpoint, but within its Allowable Value, is

(continued)



BASES

LCO(continued)

acceptable. A channel is inoperable if its actual tripsetting is not within its required Allowable Value. Tripsetpoints are those predetermined values of output at whichan action should take place. The setpoints are compared tothe actual process parameter (e.g., overvoltage), and whenthe measured output value of the process parameter exceedsthe setpoint, the associated device changes state.

The overvoltage Allowable Values for the RPS electricalpower monitoring assembly trip logic are derived from vendorspecified voltage requirements.

The underfrequency Allowable Values for the RPS electricalpower monitoring assembly trip logic are based on testsperformed at Peach Bottom which concluded that the lowestfrequency which would be reached was 54.4 Hz in 7.5 to 11.0seconds depending load. Bench tests were also performed onRPS components (HFA relays, scram contactors, and scramsolenoid valves) under conditions more severe than thoseexpected in the plant (53 Hz during 11.0 and 15.0 secondintervals). Examination of these components concluded thatthe components functioned correctly under these conditions.

The undervoltage Allowable Values for the RPS electricalpower monitoring assembly trip logic were confirmed to beacceptable through testing. Testing has shown the scrampilot solenoid valves can be subjected to voltages below 95volts with no degradation in their ability to perform theirsafety function. It was concluded the RPS logic relays andscram contactors will not be adversely affected by voltagebelow 95 volts since these components will dropout underthese voltage conditions thereby satisfying their safetyfunction.

0

APPLICABILITY The operation of the RPS electric power monitoringassemblies is essential to disconnect the RPS componentsfrom the MG set or alternate power supply during abnormalvoltage or frequency conditions. Since the degradation of anonclass IE source supplying power to the RPS bus can occuras a result of any random single failure, the OPERABILITY ofthe RPS electric power monitoring assemblies is requiredwhen the RPS components are required to be OPERABLE. Thisresults in the RPS Electric Power Monitoring SystemOPERABILITY being required in MODES I and 2; and in MODES 3,4, and 5 with any control rod withdrawn from a core cellcontaining one or more fuel assemblies.

(continued)



BASES (continued)

ACTIONS A.1

If one RPS electric power monitoring assembly for aninservice power supply (MG set or alternate) is inoperable,or one RPS electric power monitoring assembly on eachinservice power supply is inoperable, the OPERABLE assemblywill still provide protection to the RPS components underdegraded voltage or frequency conditions. However, thereliability and redundancy of the RPS Electric PowerMonitoring System is reduced, and only a limited time(72 hours) is allowed to restore the inoperable assembly toOPERABLE status. If the inoperable assembly cannot berestored to OPERABLE status, the associated power supply(s)must be removed from service (Required Action A.1). Thisplaces the RPS bus in a safe condition. An alternate powersupply with OPERABLE powering monitoring assemblies may thenbe used to power the RPS bus.

The 72 hour Completion Time takes into account the remainingOPERABLE electric power monitoring assembly and the lowprobability of an event requiring RPS electric powermonitoring protection occurring during this period. Itallows time for plant operations personnel to takecorrective actions or to place the plant in the requiredcondition in an orderly manner and without challenging plantsystems.

Alternately, if it is not desired to remove the power supplyfrom service (e.g., as in the case where removing the powersupply(s) from service would result in a scram orisolation), Condition C or D, as applicable, must be enteredand its Required Actions taken.

B.1

If both power monitoring assemblies for an inservice powersupply (MG set or alternate) are inoperable or both powermonitoring assemblies in each inservice power supply areinoperable, the system protective function is lost. In thiscondition, I hour is allowed to restore one assembly toOPERABLE status for each inservice power supply. If oneinoperable assembly for each inservice power supply cannotbe restored to OPERABLE status, the associated powersupply(s) must be removed from service within I hour(Required Action B.1). An alternate power supply withOPERABLE assemblies may then be used to power one RPS bus.

(continued)



BASES


The 1 hour Completion Time is sufficient for the plantoperations personnel to take corrective actions and isacceptable because it minimizes risk while allowing time forrestoration or removal from service of the electric powermonitoring assemblies.

Alternately, if it is not desired to remove the powersupply(s) from service (e.g., as in the case where removingthe power supply(s) from service would result in a scram orisolation), Condition C or D, as applicable, must be enteredand its Required Actions taken.

C.1 and C.2

If any Required Action and associated Completion Time ofCondition A or B are not met in MODE I or 2, a plantshutdown must be performed. This places the plant in acondition where minimal equipment, powered through theinoperable RPS electric power monitoring assembly(s), isrequired and ensures that the safety function of the RPS(e.g., scram of control rods) is not required. The plantshutdown is accomplished by placing the plant in MODE 3within 12 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.

D.1

If any Required Action and associated Completion Time ofCondition A or B are not met in MODE 3, 4, or 5 with anycontrol rod withdrawn from a core cell containing one ormore fuel assemblies, the operator must immediately initiateaction to fully insert all insertable control rods in corecells containing one or more fuel assemblies. RequiredAction D.1 results in the least reactive condition for thereactor core and ensures that the safety function of the RPS(e.g., scram of control rods) is not required.

(continued)



BASES (continued)


A CHANNEL FUNCTIONAL TEST is performed on each overvoltage,undervoltage, and underfrequency channel to ensure that theentire channel will perform the intended function. Anysetpoint adjustment shall be consistent with designdocuments.

As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST isonly required to be performed while the plant is in acondition in which the loss of the RPS bus will notjeopardize steady state power operation (the design of thesystem is such that the power source must be removed fromservice to conduct the Surveillance). As such, thisSurveillance is required to be performed when the unit is inMODE 4 for Ž 24 hours and the test has not been performed inthe previous 184 days. This Surveillance must be performedprior to entering MODE 2 or 3 from MODE 4 if a performanceis required. The 24 hours is intended to indicate an outageof sufficient duration to allow for scheduling and properperformance of the Surveillance.

The 184 day Frequency and the Note in the Surveillance arebased on guidance provided in Generic Letter 91-09 (Ref. 2).

SR 3.3.8.2.2 and SR 3.3.8.2.3

CHANNEL CALIBRATION is a complete check of the relaycircuitry and applicable time delay relays. This testverifies that the channel responds to the measured parameterwithin the necessary range and accuracy. CHANNELCALIBRATION leaves the channel adjusted between successivecalibrations consistent with the plant design documents.

The Frequency is based on the assumption of a 24 monthcalibration interval in the determination of the magnitudeof equipment drift in the setpoint analysis.

SR 3.3.8.2.4

Performance of a system functional test demonstrates that,with a required system actuation (simulated or actual)signal, the logic of the system will automatically trip openthe associated power monitoring assembly. Only one signal

(continued)



BASES


SR 3.3.8.2.4 (continued)

per power monitoring assembly is required to be tested.This Surveillance overlaps with the CHANNEL CALIBRATION toprovide complete testing of the safety function. The systemfunctional test of the Class IE circuit breakers is includedas part of this test to provide complete testing of thesafety function. If the breakers are incapable ofoperating, the associated electric power monitoring assemblywould be inoperable.


REFERENCES I. UFSAR, Section 7.2.3.2.

2. NRC Generic Letter 91-09, "Modification ofSurveillance Interval for the Electrical ProtectiveAssemblies in Power Supplies for the ReactorProtection System."




B TABLE OF CONTENTS

page(s) i ...................................................................................................................... Rev 25


page(s) 2.0-1 ........... Rev 472.0-3 ....................................................... Rev 472.0-4 .......................... Rev 472.0-5 ..................................... Rev 572.0-6 .............................................................................................................. Rev 572.0-8 .............................................................................................................. Rev 572.0-9 .............................................................................................................. Rev 572.0-10 ............................................................................................................ Rev 57


page(s) 3.0-5 .............................................................................................................. Rev 523.0-5a ............................................................................................................ Rev 523.0-6 .............................................................................................................. Rev 523.0-12 .............................................................................................................. Rev 63.0-13 .............................................................................................................. Rev 13.0-14 ............................................................................................................ Rev 523.0-15 ............................................................................................................ Rev 52


page(s) 3.1-14 ........................................................................................................... Rev 493.1-15 - 18 (inclusive) ................................................................................... Rev 23.1-23 ........................................................................................................... Rev 493.1-23 ........................................................................................................... Rev 493.1-25 ........................................................................................................... Rev 573.1-26 ............................................................................................................. Rev 93.1-27 ........................................................................................................... Rev 573.1-28 ............................................................................................................. Rev 93.1-29 ........................................................................................................... Rev 493.1-31 - 33 (inclusive) .................................................................................. Rev 23.1-49 ............................................................................................................ Rev 573.1-50 ........................................................................................................... Rev 57


page(s) 3.2-1 - 5 (inclusive) ..................................................................................... Rev 493.2-7 ............................................................................................................. Rev 473.2-8 ............................................................................................................. Rev 243.2-9 ............................................................................................................. Rev 573.2-10 ........................................................................................................... Rev 473.2-11 .......................................................................................................... Rev 473.2-12 ........................................................................................................... Rev 493.2-12a ......................................................................................................... Rev 493.2-13 ........................................................................................................... Rev 47

PBAPS Unit 2 i Revision No. 60




page(s) 3.3-5 - 6 (inclusive) ..................................................................................... Rev 243.3-7 ............................................................................................................. Rev 543.3-8 ............................................................................................................. Rev 503.3-9 ............................................................................................................. Rev 503.3-10 ........................................................................................................... Rev 363.3-11 ........................................................................................................... Rev 363.3-12 ........................................................................................................... Rev 503.3-12a ......................................................................................................... Rev 503.3-12b ......................................................................................................... Rev 503.3-18 - 19 (inclusive) ................................................................................. Rev 433.3-23 ........................................................................................................... Rev 363.3-24 ........................................................................................................... Rev 503.3-25 ........................................................................................................... Rev 503.3-26 ........................................................................................................... Rev 363.3-27 ........................................................................................................... Rev 543.3-27a ......................................................................................................... Rev 543.3-28 ........................................................................................................... Rev 363.3-29 ........................................................................................................... Rev 493.3-30 .......................................................................................................... Rev 363.3-31 ........................................................................................................... Rev 363.3-32 ........................................................................................................... Rev 503.3-33 ........................................................................................................... Rev 503.3-34 ........................................................................................................... Rev 503.3-35 ........................................................................................................... Rev 503.3-35a ......................................................................................................... Rev 543.3-35b ........................................................................................................ Rev 503.3-36 - 44 (inclusive) ................................................................................. Rev 243.3-45 - 46 (inclusive) ................................................................................. Rev 363.3-52 - 55 (inclusive) ................................................................................. Rev 363.3-57 ........................................................................................................... Rev 363.3-59 ........................................................................................................... Rev 433.3-60 ........................................................................................................... Rev 493.3-62 ........................................................................................................... Rev 573.3-67 ............................................................................................................. Rev 73.3-68 ............................................................................................................. Rev 33.3-69 ........................................................................................................... Rev 573.3-70 ........................................................................................................... Rev 553.3-71 ........................................................................................................... Rev 523.3-72 - 73 (inclusive) ................................................................................... Rev 33.3-74 ........................................................................................................... Rev 553.3-75 ........................................................................................................... Rev 553.3-78 ........................................................................................................... Rev 523.3-89 ........................................................................................................... Rev 573.3-91 h ......................................................................................................... Rev 253.3-91 i ......................................................................................................... Rev 433.3-91a ......................................................................................................... Rev 253.3-91 b ......................................................................................................... Rev 493.3-91c ......................................................................................................... Rev 493.3-91d - 91e (inclusive) ............................................................................ Rev 433.3-91f .......................................................................................................... Rev 573.3-91g ......................................................................................................... Rev 573.3-91j ......................................................................................................... Rev 253.3-98 ........................................................................................................... Rev 213.3-99 ............................................................................................. .............. Rev 57

PBAPS Unit 2 ii Revision No. 60



B 3.3 INSTRUMENTATION (continued)

page(s) 3.3-100 ......................................................................................................... Rev 573.3-101 ......................................................................................................... Rev 573.3-102 ......................................................................................................... Rev 573.3-103 ......................................................................................................... Rev 573.3-104 ......................................................................................................... Rev 573.3-106 ......................................................................................................... Rev 573.3-124 ......................................................................................................... Rev 583.3-125 ......................................................................................................... Rev 583.3-142 ......................................................................................................... Rev 483.3-143 ......................................................................................................... Rev 483.3-144 ......................................................................................................... Rev 573.3-145 ......................................................................................................... Rev 573.3-149 ......................................................................................................... Rev 483.3-149a ....................................................................................................... Rev 483.3-151 ......................................................................................................... Rev 203.3-155 ......................................................................................................... Rev 323.3-159 ......................................................................................................... Rev 573.3-159a ....................................................................................................... Rev 573.3-160 ......................................................................................................... Rev 573.3-161 ......................................................................................................... Rev 483.3-162 ......................................................................................................... Rev 453.3-166 ......................................................................................................... Rev 483.3-167 ......................................................................................................... Rev 203.3-168 - 186 (inclusive) ............................................................................... Rev 13.3-187 .......................................................................................................... Rev 53.3-188 - 190 (inclusive) ............................................................................ Rev 303.3-191 - 198 (inclusive) ............................................................................... Rev 53.3-199 - 205 .................................................................................................. Rev 1


page(s) 3.4-3 ............................................................................................................. Rev 503.4-4 ............................................................................................................. Rev 503.4-5 ............................................................................................................. Rev 503.4-6 ............................................................................................................. Rev 503.4-7 ............................................................................................................. Rev 503.4-8 ...................... Rev 503.4-9 .............................................................................................................. Rev 503.4-10 ........................................................................................................... Rev 503.4-18 ......................................................................................................... Rev 233.4-25 ......................................................................................................... Rev 603.4-27 ......................................................................................................... Rev 523.4-31 .......................................................................................................... Rev 523.4-35 ......................................................................................................... Rev 523.4-39 ......................................................................................................... Rev 13.4-52 ......................................................................................................... Rev 49

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR COREISOLATION COOLING (RCIC) SYSTEM

page(s) 3.5-5 ............................................................................................................. Rev 573.5-6 ............................................................................................. Rev 573.5-10 ........................................................................................................... Rev 563.5-11 ......................................................................................................... Rev 573.5-14 - 15 (inclusive) ................................................................................... Rev 23.5-16 .......................................................................................................... Rev 233.5-17 .......................................................................................................... Rev 513.5-19 ........................................................................................................... Rev 57

PBAPS Unit 2 iii Revision No. 60



B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR COREISOLATION COOLING (RCIC) SYSTEM (continued)

page(s) 3.5-22 .......................................................... ....... .... Rev 573.5-23 ........................................................................................................... Rev 573.5-26 ........................................................................................................... Rev 523.5-27 ........................................................................................................... Rev 563.5-28 ........................................................................................................... Rev 42


page(s) 3.6-1 ............................................................................................................. Rev 273.6-2 ............................................................................................................. Rev 193.6-3 ............................................................................................................... Rev 63.6-4 - 5 (inclusive) ..................................................................................... Rev 223.6-7 ............................................................................................................ Rev 523.6-11 ............................................................................................................. Rev 63.6-12 ........................................................................................................... Rev 573.6-13 ........................................................................................................... Rev 193.6-17 - 18 (inclusive) ................................................................................... Rev 23.6-20 ........................................................................................................... Rev 573.6-21 ........................................................................................................... Rev 573.6-22 ........................................................................................................... Rev 573.6-25 ........................................................................................................... Rev 573.6-26 ........................................................................................................... Rev 573.6-27 ........................................................................................................... Rev 573.6-28 ........................................................................................................... Rev 353.6-29 ........................................................................................................... Rev 223.6-30 .......................................................................................................... Rev 573.6-31 .......................................................................................................... Rev 183.6-33 ..................................................... Rev 193.6-43 ........................................................................................................... Rev 443.6-47 ........................................................................................................... Rev 443.6-49 - 51 (inclusive) ................................................................................. Rev 243.6-58 ............................................................................................................. Rev 13.6-64 - 66 (inclusive) ................................................................................. Rev 373.6-69 ........................................................................................................... Rev 373.6-76 ........................................................................................................... Rev 573.6-77 ........................................................................................................... Rev 573.6-79 ........................................................................................................... Rev 573.6-81 ........................................................................................................... Rev 573.6-82 ........................................................................................................... Rev 573.6-83 .......................................................................................................... Rev 573.6-90 ............................................................................................................. Rev 1

B 3.7 PLANT SYSTEMS

page(s) 3.7-1 ............................................................................................................. Rev 173.7-6 ............................................................................................................... Rev 43.7-7 ............................................................................................................. Rev 113.7-8 ............................................................................................................. Rev 563.7-8a ........................................................................................................... Rev 333.7-9 ............................................................................................................. Rev 563.7-12 ............................................................................................................. Rev 23.7-13 ............................................................................................................. Rev 13.7-15 ........................................................................................................... Rev 343.7-21 ........................................................................................................... Rev 203.7-26 ........................................................................................................... Rev 493.7-27 ..................................................... Rev 493.7-29 ........................................................................................................... Rev 31

PBAPS Unit 2 iv Revision No. 60




page(s) 3.8-2 - 3 (inclusive) ........................................................ Rev 333.8-5 ................................................................................... ....... .......... Rev 53.8-6 .............................................................................................................. Rev 523.8-7 ................................................................................................................ Rev 53.8-8 ................................................................................................................ Rev 53.8-9 .............................................................................................................. Rev 383.8-10 .......................................................... Rev 53.8-11 ........................................................................................................... Rev 603.8-12 .............................................................................................................. Rev 13.8-22 ............................................................................................................ Rev 323.8-24 .............................................................................................................. Rev 13.8-25 .............................................................................................................. Rev 13.8-26 ............................................................................................................ Rev 573.8-27 ............................................................................................................ Rev 573.8-27a .......................................................................................................... Rev 573.8-28 .............................................................................................................. Rev 13.8-29 .............................................................................................................. Rev 13.8-30 ................................................................................. ....................... Rev 13.8-31 ............................................................................................................ Rev 573.8-32 ............................................................................................................ Rev 573.8-35 - 37 (inclusive) ................................................................................. Rev 103.8-42 ........................................................................................................... Rev 573.8-46 - 47 (inclusive) ................................................................................. Rev 163.8-55 ........................................................................................................... Rev 37


page(s) 3.9-1 ............................................................................................................. Rev 293.9-3 ............................................................................................................. Rev 293.9-8 ............................................................................................................. Rev 243.9-10 ........................................................................................................... Rev 243.9-14 ........................................................................................................... Rev 243.9-15 ........................................................................................................... Rev 2


page(s) 3.10-1 ............................................................................................................. Rev 13.10-5 ........................................................................................................... Rev 243.10-31 ......................................................................................................... Rev 243.10-32 ......................................................................................................... Rev 363.10-35 ......................................................................................................... Rev 363.10-36 ........................................................................................................... Rev 2

All remaining pages are Rev 0 dated 1/18/96.

PBAPS Unit 2 v Revision No. 60

Recirculation Loops OperatingB 3.4.1


B 3.4.1 Recirculation Loops Operating

BASES

BACKGROUND The Reactor Coolant Recirculation System is designed toprovide a forced coolant flow through the core to removeheat from the fuel. The forced coolant flow removes moreheat from the fuel than would be possible with just naturalcirculation. The forced flow, therefore, allows operationat significantly higher power than would otherwise bepossible. The recirculation system also controls reactivityover a wide span of reactor power by varying therecirculation flow rate to control the void content of themoderator. The Reactor Coolant Recirculation Systemconsists of two recirculation pump loops external to thereactor vessel. These loops provide the piping path for thedriving flow of water to the reactor vessel jet pumps. Eachexternal loop contains one variable speed motor drivenrecirculation pump, a motor generator (MG) set to controlpump speed and associated piping, jet pumps, valves, andinstrumentation. The recirculation loops are part of thereactor coolant pressure boundary and are located inside thedrywell structure. The jet pumps are reactor vesselinternals.

The recirculated coolant consists of saturated water fromthe steam separators and dryers that has been subcooled byincoming feedwater. This water passes down the annulusbetween the reactor vessel wall and the core shroud. Aportion of the coolant flows from the vessel, through thetwo external recirculation loops, and becomes the drivingflow for the jet pumps. Each of the two externalrecirculation loops discharges high pressure flow into anexternal manifold, from which individual recirculation inletlines are routed to the jet pump risers within the reactorvessel. The remaining portion of the coolant mixture in theannulus becomes the suction flow for the jet pumps. Thisflow enters the jet pump at suction inlets and isaccelerated by the driving flow. The drive flow and suctionflow are mixed in the jet pump throat section. The totalflow then passes through the jet pump diffuser section intothe area below the core (lower plenum), gaining sufficienthead in the process to drive the required flow upwardthrough the core. The subcooled water enters the bottom ofthe fuel channels and contacts the fuel cladding, where heatis transferred to the coolant. As it rises, the coolant

(continued)



BASES


begins to boil, creating steam voids within the fuel channelthat continue until the coolant exits the core. Because ofreduced moderation, the steam voiding introduces negativereactivity that must be compensated for to maintain or toincrease reactor power. The recirculation flow controlallows operators to increase recirculation flow and sweepsome of the voids from the fuel channel, overcoming thenegative reactivity void effect. Thus, the reason forhaving variable recirculation flow is to compensate forreactivity effects of boiling over a wide range of powergeneration (i.e., 65 to 100% of RTP) without having to movecontrol rods and disturb desirable flux patterns.

Each recirculation loop is manually started from the controlroom. The MG set provides regulation of individualrecirculation loop drive flows. The flow in each loop ismanually controlled.


The operation of the Reactor Coolant Recirculation System isan initial condition assumed in the design basis loss ofcoolant accident (LOCA) (Ref. 1). During a LOCA caused by arecirculation loop pipe break, the intact loop is assumed toprovide coolant flow during the first few seconds of theaccident. The initial core flow decrease is rapid becausethe recirculation pump in. the broken loop ceases to pumpreactor coolant to the vessel almost immediately. The pumpin the intact loop coasts down relatively slowly. This pumpcoastdown governs the core flow response for the nextseveral seconds until the jet pump suction is uncovered.The analyses assume that both loops are operating at thesame flow prior to the accident. However, the LOCA analysiswas reviewed for the case with a flow mismatch between thetwo loops, with the pipe break assumed to be in the loopwith the higher flow. While the flow coastdown and coreresponse are potentially more severe in this assumed case(since the intact loop starts at a lower flow rate and thecore response is the same as if both loops were operating ata lower flow rate), a small mismatch has been determined tobe acceptable based on engineering judgement. Therecirculation system is also assumed to have sufficient flowcoastdown characteristics to maintain fuel thermal marginsduring abnormal operational transients, which are analyzedin Chapter 14 of the UFSAR.

(continued)



BASES


(continued)

Plant specific LOCA and average power range monitor/rodblock monitor Technical Specification/maximum extended loadline limit analyses have been performed assuming only oneoperating recirculation loop. These analyses demonstratethat, in the event of a LOCA caused by a pipe break in theoperating recirculation loop, the Emergency Core CoolingSystem response will provide adequate core cooling (Refs. 2,3, and 4).

The transient analyses of Chapter 14 of the UFSAR have alsobeen performed for single recirculation loop operation(Ref. 5) and demonstrate sufficient flow coastdowncharacteristics to maintain fuel thermal margins during theabnormal operational transients analyzed provided the MCPRrequirements are modified. During single recirculation loopoperation, modification to the Reactor Protection System(RPS) average power range monitor (APRM) instrumentsetpoints is also required to account for the differentrelationships between recirculation drive flow and reactorcore flow. The MCPR limits and APLHGR limits (power-dependent APLHGR multipliers, MAPFACP, and flow-dependentAPLHGR multipliers, MAPFACf) for single loop operation arespecified in the COLR. The APRM Simulated Thermal Power-High Allowable Value is in LCO 3.3.1.1, "Reactor ProtectionSystem (RPS) Instrumentation."

(continued)

PBAPS UNIT 2 B 3.4ý3 Revision No. 50


BASES

APPLICABLESAFETY ANALYSES(continued)

Recirculation loops operating satisfies Criterion 2 of theNRC Policy Statement.

LCO Two recirculation loops are normally required to be inoperation with their flows matched within the limitsspecified in SR 3.4.1.1 to ensure that during a LOCA causedby a break of the piping of one recirculation loop the

(continued)



BASES

LCO(continued) assumptions of the LOCA analysis are satisfied.

Alternatively, with only one recirculation loop inoperation, modifications to the required APLHGR limits(power- and flow-dependent APLHGR multipliers, MAPFACP andMAPFACf, respectively of LCO 3.2.1, "AVERAGE PLANAR LINEARHEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2,"MINIMUM CRITICAL POWER RATIO (MCPR)") and APRM SimulatedThermal Power-High Allowable Value (LCO 3.3.1.1) must beapplied to allow continued operation consistent with theassumptions of Reference 5.

The LCO is modified by a Note which allows up to 12 hoursbefore having to put in effect the required modifications torequired limits after a change in the reactor operatingconditions from two recirculation loops operating to singlerecirculation loop operation. If the required limits arenot in compliance with the applicable requirements at theend of this period, the associated equipment must bedeclared inoperable or the limits "not satisfied," and theACTIONS required by nonconformance with the applicablespecifications implemented. This time is provided due tothe need to stabilize operation with one recirculation loop,including the procedural steps necessary to limit flow inthe operating loop, and the complexity and detail requiredto fully implement and confirm the required limitmodifications.

APPLICABILITY In MODES 1 and 2, requirements for operation of the ReactorCoolant Recirculation System are necessary since there isconsiderable energy in the reactor core and the limitingdesign basis transients and accidents are assumed to occur.

In MODES 3, 4, and 5, the consequences of an accident arereduced and the coastdown characteristics of therecirculation loops are not important.

(continued)


Reci rcul ati on Loops OperatingB 3.4.1

BASES

THIS PAGE LEFT BLANK INTENTIONALLY

(The contents of this page have been deleted)



BASES

ACTIONS(continued)

A.1

With the requirements of the LCO not met, the recirculationloops must be restored to operation with matched flowswithin 24 hours. A recirculation loop is considered not inoperation when the pump in that loop is idle or whenthemismatch between total jet pump flows of the two loops isgreater than required limits. The loop with the lower flowmust be considered not in operation. Should a LOCA occurwith one recirculation loop not in operation, the core flowcoastdown and resultant core response may not be bounded bythe LOCA analyses. Therefore, only a limited time isallowed to restore the inoperable loop to operating status.

Alternatively, if the single loop requirements of the LCOare applied to operating limits and RPS setpoints, operationwith only one recirculation loop would satisfy therequirements of the LCO and the initial conditions of theaccident sequence.

The 24 hour Completion Time is based on the low probabilityof an accident occurring during this time period, on areasonable time to complete the Required Action, and onfrequent core monitoring by operators allowing abruptchanges in core flow conditions to be quickly detected.

(continued)



BASES


This Required Action does not require tripping therecirculation pump in the lowest flow loop when the mismatchbetween total jet pump flows of the two loops is greaterthan the required limits. However, in cases where largeflow mismatches occur, low flow or reverse flow can occur inthe low flow loop jet pumps, causing vibration of the jetpumps. If zero or reverse flow is detected, the conditionshould be alleviated by changing pump speeds to re-establishforward flow or by tripping the pump.

B.1

With no recirculation loops in operation or the RequiredAction and associated Completion Time of Condition A notmet, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought t~o MODE 3 within 12 hours. In this condition, therecirculation loops are not required to be operating becauseof the reduced severity of DBAs and minimal dependence onthe recirculation loop coastdown characteristics. Theallowed Completion Time of 12 hours is reasonable, based onoperating experience, to reach MODE 3 from full powerconditions in an orderly manner and without challengingplant systems.

(continued)



BASES


This SR ensures the recirculation loops are within theallowable limits for mismatch. At low core flow (i.e.,< 71.75 X 106 lbm/hr), the MCPR requirements provide largermargins to the fuel cladding integrity Safety Limit suchthat the potential adverse effect of early boilingtransition during a LOCA is reduced. A larger flow mismatchcan therefore be allowed when core flow is < 71.75 X106 Ibm/hr. The recirculation loop jet pump flow, as usedin this Surveillance, is the summation of the flows from allof the jet pumps associated with a single recirculationloop.

The mismatch is measured in terms of core flow. (Rated coreflow is 102.5 X 106 lbm/hr. The first limit is based onmismatch _< 10% of rated core flow when operating at < 70% ofrated core flow. The second limit is based on mismatch •< 5%of rated core flow when operating at > 70% of rated coreflow.) If the flow mismatch exceeds the specified limits,the loop with the lower flow is considered not in operation.The SR is not required when both loops are not in operationsince the mismatch limits are meaningless during single loopor natural circulation operation. The Surveillance must beperformed within 24 hours after both loops are in operation.The 24 hour Frequency is consistent with the SurveillanceFrequency for jet pump OPERABILITY verification and has beenshown by operating experience to be adequate to detect offnormal jet pump loop flows in a timely manner.

(continued)



BASES


2. NEDC-32163P, "PBAPS Units 2 and 3 SAFER/GESTR-LOCALoss-of-Coolant Accident Analysis," January 1993.

3. NEDC-32162P, "Maximum Extended Load Line Limit andARTS Improvement Program Analyses for Peach BottomAtomic Power Station Unit 2 and 3," Revision 1,February 1993.

4. NEDC-32428P, "Peach Bottom Atomic Power Station Unit 2Cycle 11 ARTS Thermal Limits Analyses," December 1994.

5. NEDO-24229-1, "PBAPS Units 2 and 3 Single-LoopOperation," May 1980.

6. NEDC-33064P, "Safety Analysis Report For Peach BottomAtomic Power Station Units 2 & 3 Thermal PowerOptimization," May 2002.


Jet PumpsB 3.4.2


B 3.4.2 Jet Pumps

BASES

BACKGROUND The Reactor Coolant Recirculation System is described in theBackground section of the Bases for LCO 3.4.1,"Recirculation Loops Operating," which discusses theoperating characteristics of the system and how thesecharacteristics affect the Design Basis Accident (DBA)analyses.

The jet pumps are reactor vessel internals and inconjunction with the Reactor Coolant Recirculation Systemare designed to provide forced circulation through the coreto remove heat from the fuel. The jet pumps are located inthe annular region between the core shroud and the vesselinner wall. Because the jet pump suction elevation is attwo-thirds core height, the vessel can be reflooded andcoolant level maintained at two-thirds core height even withthe complete break of the recirculation loop pipe that islocated below the jet pump suction elevation.

Each reactor coolant recirculation loop contains ten jetpumps. Recirculated coolant passes down the annulus betweenthe reactor vessel wall and the core shroud. A portion ofthe coolant flows from the vessel, through the two externalrecirculation loops, and becomes the driving flow for thejet pumps. Each of the two external recirculation loopsdischarges high pressure flow into an external manifold fromwhich individual recirculation inlet lines are routed to thejet pump risers within the reactor vessel. The remainingportion of the coolant mixture in the annulus becomes thesuction flow for the jet pumps. This flow enters the jetpump at suction inlets and is accelerated by the drive flow.The drive flow and suction flow are mixed in the jet pumpthroat section. The total flow then passes through the jetpump diffuser section into the area below the core (lowerplenum), gaining sufficient head in the process to drive therequired flow upward through the core.

APPLICABLE Jet pump OPERABILITY is an implicit assumption in the designSAFETY ANALYSES basis loss of coolant accident (LOCA) analysis evaluated in

Reference 1.

(continued)


Jet PumpsB 3.4.2

BASES


(continued)

The capability of reflooding the core to two-thirds coreheight is dependent upon the structural integrity of the jetpumps. If the structural system, including the beam holdinga jet pump in place, fails, jet pump displacement andperformance degradation could occur, resulting in anincreased flow area through the jet pump and a lower coreflooding elevation. This could adversely affect the waterlevel in the core during the reflood phase of a LOCA as wellas the assumed blowdown flow during a LOCA.

Jet pumps satisfy Criterion 2 of the NRC Policy Statement.

LCO The structural failure of any of the jet pumps could causesignificant degradation in the ability of the jet pumps toallow reflooding to two-thirds core height during a LOCA.OPERABILITY of all jet pumps is required to ensure thatoperation of the Reactor Coolant Recirculation System willbe consistent with the assumptions used in the licensingbasis analysis (Ref. 1).

APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLEsince there is a large amount of energy in the reactor coreand since the limiting DBAs are assumed to occur in theseMODES. This is consistent with the requirements foroperation of the Reactor Coolant Recirculation System(LCO 3.4.1).

In MODES 3, 4, and 5, the Reactor Coolant RecirculationSystem is not required to be in operation, and when not inoperation, sufficient flow is not available-to evaluate jetpump OPERABILITY.

ACTIONS A.__

An inoperable jet pump can increase the blowdown area andreduce the capability of reflooding during a design basisLOCA. If one or more of the jet pumps are inoperable, theplant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought toMODE 3 within 12 hours. The Completion Time of 12 hours isreasonable, based on operating experience, to reach MODE 3from full power conditions in an orderly manner and withoutchallenging plant systems.

(continued)


Jet PumpsB 3.4.2

BASES (continued)

SURVEILLANCE SR 3.4.2.1

REQUIRMENTS This SR is designed to detect significant degradation in jetpump performance that precedes jet pump failure (Ref. 2).This SR is required to be performed only when the loop hasforced recirculation flow since surveillance checks-andmeasurements can only be performed during jet pumpoperation. The jet pump failure of concern is a completemixer displacement due to jet pump beam failure. Jet pumpplugging is also of concern since it adds flow resistance tothe recirculation loop. Significant degradation isindicated if the specified criteria confirm unacceptabledeviations from established patterns or relationships. Theallowable deviations from the established patterns have beendeveloped based on the variations experienced at plantsduring normal operation and with jet pump assembly failures(Refs. 2 and 3). Each recirculation loop must satisfy oneof the performance criteria provided. Since refuelingactivities (fuel assembly replacement or shuffle, as well asany modifications to fuel support orifice size or core platebypass flow) can affect the relationship between core flow,jet pump flow, and recirculation loop flow, theserelationships may need to be re-established each cycle.__Similarly, initial entry into extended single loop operationmay also require establishment of these relationships.WDuring the initial weeks of operation under such conditions,while basel ining new "established patterns," engineeringjudgement of the daily surveillance results is used todetect significant abnormalities which could indicate a jetpump failure.

The recirculation pump speed operating characteristics (pumpflow and loop flow versus pump speed) are determined by theflow resistance from the loop suction through the jet pumpnozzles. A change in the relationship indicates a plug,flow restriction, loss in pump hydraulic performance,leakage, or new flow path between the recirculation pumpdischarge and jet pump nozzle. For this criterion, the pumpflow and loop flow versus pump speed relationship must beverified.

Individual jet pumps in a recirculation loop normally do nothave the same flow. The unequal flow is due to the driveflow manifold, which does not distribute flow equally to allrisers. The flow (or jet pump diffuser to lower plenumdifferential pressure) pattern or relationship of one jet

(continued)s

PBAPS UNIT 2 B 3.4-13 PBAP UNT 2 3.-13Revision No. 0

Jet PumpsB 3.4.2

BASES


pump to the loop average is repeatable. An appreciablechange in this relationship is an indication that increased(or reduced) resistance has occurred in one of the jetpumps. This may be indicated by an increase in the relativeflow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of apotential problem in the recirculation drive flow or jetpump system (Ref. 2). Normal flow ranges and establishedjet pump flow and differential pressure patterns areestablished by plotting historical data as discussed inReference 2.

The 24 hour Frequency has been shown by operating experienceto be timely for detecting jet pump degradation and isconsistent with-the Surveillance Frequency for recirculationloop OPERABILITY verification.

This SR is modified by two Notes. Note I allows thisSurveillance not to be performed until 4 hours after theassociated recirculation loop is in operation, since thesechecks can only be performed during jet pump operation. The4 hours is an acceptable time to establish conditionsappropriate for data collection and evaluation.

Note 2 allows this SR not to be performed until 24 hoursafter THERMAL POWER exceeds 25%-of RTP. During low flowconditions, jet pump noise approaches the threshold responseof the associated flow instrumentation and precludes thecollection of repeatable and meaningful data. The 24 hoursis an acceptable time to establish conditions appropriate toperform this SR.

REFERENCES I. UFSAR, Section 14.6.3.

2. GE Service Information Letter No. 330, "Jet Pump BeamCracks," June 9, 1980.

3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07: BWRJet Pump Assembly Failure," November 1984.

PBAPS UNIT 2 BB 3.4-14 Revision No. 0

SRVs and SVsB 3.4.3


B 3.4.3 Safety Relief Valves (SRVs) and Safety Valves (SVs)

BASES

BACKGROUND The ASME Boiler and Pressure Vessel Code requires thereactor pressure vessel be protected from overpressureduring upset conditions by self-actuated safety valves. Aspart of the nuclear pressure relief system, the size andnumber of SRVs and SVs are selected such that peak pressurein the nuclear system will not exceed the ASME Code limitsfor the reactor coolant pressure boundary (RCPB).

The SRVs and SVs are located on the main steam lines betweenthe reactor vessel and the first isolation valve within thedrywell. The SRVs can actuate by either of two modes: thesafety mode or the depressurization mode. In the safetymode, the pilot disc opens when steam pressure at the valveinlet expands the bellows to the extent that the hydraulicseating force on the pilot disc is reduced to zero. Openingof the pilot stage allows a pressure differential to developacross the second stage disc which opens the second stagedisc, thus venting the chamber over the main valve piston.This causes a pressure differential across the main valvepiston which opens the main valve. The SVs are springloaded valves that actuate when steam pressure at the inletovercomes the spring force holding the valve disc closed.This satisfies the Code requirement.

Each of the 11 SRVs discharge steam through a discharge lineto a point below the minimum water level in the suppressionpool. The two SVs discharge steam directly to the drywell.In the depressurization mode, the SRV is opened by apneumatic actuator which opens the second stage disc. Themain valve then opens as described above for the safetymode. The depressurization mode provides controlleddepressurization of the reactor coolant pressure boundary.All 11 of the SRVs function in the safety mode and have thecapability to operate in the depressurization mode viamanual actuation from the control room. Five of the SRVsare allocated to the Automatic Depressurization System(ADS). The ADS requirements are specified in LCO 3.5.1,"ECCS-Operating."

(continued)


SRVs and SVsB 3.4.3

BASES (continued)


The overpressure protection system must accommodate the mostsevere pressurization transient. Evaluations havedetermined that the most severe transient is the closure ofall main steam isolation valves (MSIVs), followed by reactorscram on high neutron flux (i.e., failure of the directscram associated with MSIV position) (Ref. 1). For thepurpose of the analyses, 11 SRVs and SMs are assumed tooperate in the safety mode. The analysis resultsdemonstrate that the design SRV and SV capacity is capableof maintaining reactor pressure below the ASME Code limit of110% of vessel design pressure (110% x 1250 psig =1375 psig). This LCO helps to ensure that the acceptancelimit of 1375 psig is met during the Design Basis Event.

From an overpressure standpoint, the design basis events arebounded by the MSIV closure with flux scram event describedabove. Reference 2 discusses additional events that areexpected to actuate the SRVs and SVs.

SRVs and SVs satisfy Criterion 3 of the NRC PolicyStatement.

LCO The safety function of any combination of 11 SRVs and SVsare required to be OPERABLE to satisfy the assumptions ofthe safety analysis (Refs. I and 2). Regarding the SRVs,the requirements of this LCO are applicable only to theircapability to mechanically open to relieve excess pressurewhen the lift setpoint is exceeded (safety mode).

The SRV and SV setpoints are established to ensure that theASME Code limit on peak reactor pressure is satisfied. TheASME Code specifications require the lowest safety valvesetpoint to be at or below vessel design pressure(1250 psig) and the highest safety valve to be set so thatthe total accumulated pressure does not exceed 1107. of thedesign pressure for overpressurization conditions. Thetransient evaluations in the UFSAR are based on thesesetpoints, but also include the additional uncertainties of+ 1% of the nominal setpoint to provide an added degree ofconservatism.

Operation with fewer valves OPERABLE than specified, or withsetpoints outside the ASME limits, could result in a moresevere reactor response to a transient than predicted,possibly resulting in the ASME Code limit on reactorpressure being exceeded.

(continued)


SRVs and SVsB 3.4.3

BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, all required SRVs and SVs must beOPERABLE, since considerable energy may be in the reactorcore and the limiting design basis transients are assumed tooccur in these MODES. The SRVs and SVs may be required toprovide pressure relief to discharge energy from the coreuntil such time that the Residual Heat Removal (RHR) Systemis capable of dissipating the core heat.

In MODE 4, decay heat is low enough for the RHR System toprovide adequate cooling, and reactor pressure is low enoughthat the overpressure limit is unlikely to be approached byassumed operational transients or accidents. In MODE 5, thereactor vessel head is unbolted or removed and the reactoris at atmospheric pressure. The SRV and SV function is notneeded during these conditions.

ACTIONS A.1 and A.2

With less than the minimum number of required SRVs or SVsOPERABLE, a transient may result in the violation of theASME Code limit on reactor pressure. If the safety functionof one or more required SRVs or SVs is inoperable, the plantmust be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to MODE 3within 12 hours and to MODE 4 within 36 hours. The allowedCompletion Times are reasonable, based on operatingexperience, to reach required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.


This Surveillance requires that the required SRVs and SVswill open at the pressures assumed in the safety analyses ofReferences 1 and 2. The demonstration of the SRV and SVsafety lift settings must be performed during shutdown,since this is a bench test, to be done in accordance withthe Inservice Testing Program. The lift setting pressureshall correspond to ambient conditions of the valves atnominal operating temperatures and pressures and be verifiedwith insulation installed simulating the in-plant condition.The SRV and SV setpoint is ± 1% for OPERABILITY.

(continued)


SRVs and SVsB 3.4.3

BASES


(continued)

SR 3.4.3.2

The pneumatic actuator of each SRV valve is stroked toverify that the second stage pilot disc rod is mechanicallydisplaced when the actuator strokes. Second stage pilot rodmovement is determined by the measurement of actuator rodtravel. The total amount of movement of the second stagepilot rod from the valve closed position to the openposition shall meet criteria established by the SRVsupplier. If the valve fails to actuate due only to thefailure of the solenoid, but is capable of opening onoverpressure, the safety function of the SRV is consideredOPERABLE.

Operating experience has shown that these components willpass the SR when performed at the 24 month Frequency, whichis based on the refueling outage. Therefore, the Frequencywas concluded to be acceptable from a reliabilitystandpoint.

REFERENCES 1. NEDC-32183P, "Power Rerate Safety Analysis Report for

Peach Bottom 2 & 3," May 1993.



RCS Operational LEAKAGEB 3.4.4


B 3.4.4 RCS Operational LEAKAGE

BASES

BACKGROUND The RCS includes systems and components that contain ortransport the coolant to or from the reactor core. Thepressure containing components of the RCS and the portionsof connecting systems out to and including the isolationvalves define the reactor coolant pressure boundary (RCPB).The joints of the RCPB components are welded or bolted.

During plant life, the joint and valve interfaces canproduce varying amounts of reactor coolant LEAKAGE, througheither normal operational wear or mechanical deterioration.Limits on RCS operational LEAKAGE are required to ensureappropriate action is taken before the integrity of the RCPBis impaired. This LCO specifies the types and limits ofLEAKAGE. This protects the RCS pressure boundary describedin 10 CFR 50.2, 10 CFR 50.55a(c), and the UFSAR (Refs. 1, 2,and 3).

The safety significance of RCS LEAKAGE from the RCPB varieswidely depending on the source, rate, and duration. *Therefore, detection of LEAKAGE in the primary containmentis necessary. Methods for quickly separating the identifiedLEAKAGE from the unidentified LEAKAGE are necessary toprovide the operators quantitative information to permitthem to take corrective action should a leak occur that isdetrimental to the safety of the facility or the public.

A limited amount of leakage inside primary containment isexpected from auxiliary systems that cannot be made 100%leaktight. Leakage from these systems should be detectedand isolated from the primary containment atmosphere, ifpossible, so as not to mask RCS operational LEAKAGEdetection.

This LCO deals with protection of the RCPB from degradationand the core from inadequate cooling, in addition topreventing the accident analyses radiation releaseassumptions from being exceeded. The consequences ofviolating this LCO include the possibility of a loss ofcoolant accident.

(continued)



BASES (continued)


The allowable RCS operational LEAKAGE limits are based onthe predicted and experimentally observed behavior of pipecracks. The normally expected background LEAKAGE due toequipment design and the detection capability of theinstrumentation for determining system LEAKAGE were alsoconsidered. The evidence from experiments suggests that,for LEAKAGE even greater than the specified unidentifiedLEAKAGE limits, the probability is small that theimperfection or crack associated with such LEAKAGE wouldgrow rapidly.

The unidentified LEAKAGE flow limit allows time forcorrective action before the RCPB could be significantlycompromised. The 5 gpm limit is a small fraction of thecalculated flow from a critical crack in the primary systempiping. Crack behavior from experimental programs (Refs. 4and 5) shows that leakage rates of hundreds of gallons perminute will precede crack instability.

The low limit on increase in unidentified LEAKAGE assumes afailure mechanism of intergranular stress corrosion cracking(IGSCC) in service sensitive type 304 and type 316austenitic stainless steel that produces tight cracks. Thisflow increase limit is capable of providing an early warningof such deterioration.

No applicable safety analysis assumes the total LEAKAGElimit. The total LEAKAGE limit considers RCS inventorymakeup capability and drywell floor sump capacity.

RCS operational LEAKAGE satisfies Criterion 2 of the NRCPolicy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE

No pressure boundary LEAKAGE is allowed, since it isindicative of material degradation. LEAKAGE of thistype is unacceptable as the leak itself could causefurther deterioration, resulting in higher LEAKAGE.Violation of this LCO could result in continueddegradation of the RCPB. LEAKAGE past seals andgaskets is not pressure boundary LEAKAGE.

(continued)



BASES

LCO b. Unidentified LEAKAGE(continued)

The 5 gpm of unidentified LEAKAGE is allowed as areasonable minimum detectable amount that thecontainment air monitoring and drywell sump levelmonitoring equipment can detect within a reasonabletime period. Violation of this LCO could result incontinued degradation of the RCPB.

c. Total LEAKAGE

The total LEAKAGE limit is based on a reasonableminimum detectable amount. The limit also accountsfor LEAKAGE from known sources (identified LEAKAGE).Violation of this LCO indicates an unexpected amountof LEAKAGE and, therefore, could indicate new oradditional degradation in an RCPB component or system.

d. Unidentified LEAKAGE Increase

An unidentified LEAKAGE increase of > 2 gpm within theprevious 24 hour period indicates a potential flaw inthe RCPB and must be quickly evaluated to determinethe source and extent of the LEAKAGE. The increase ismeasured relative to the steady state value; temporarychanges in LEAKAGE rate as a result of transientconditions (e.g., startup) are not considered. Assuch, the 2 gpm increase limit is only applicable inMODE 1 when operating pressures and temperatures areestablished. Violation of this LCO could result incontinued degradation of the RCPB.

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCOapplies, because the potential for RCPB LEAKAGE is greatestwhen the reactor is pressurized.

In MODES 4 and 5, RCS operational LEAKAGE limits are notrequired since the reactor is not pressurized and stressesin the RCPB materials and potential for LEAKAGE are reduced.

(continued)



BASES (continued)

ACTIONS A.1

With RCS unidentified or total LEAKAGE greater than thelimits, actions must be taken to reduce the leak. Becausethe LEAKAGE limits are conservatively below the LEAKAGE thatwould constitute a critical crack size, 4 hours is allowedto reduce the LEAKAGE rates before the reactor must be shutdown. If an unidentified LEAKAGE has been identified andquantified, it may be reclassified and considered asidentified LEAKAGE; however, the total LEAKAGE limit wouldremain unchanged.

B.1 and B.2

An unidentified LEAKAGE increase of > 2 gpm within a 24 hourperiod is an indication of a potential flaw in the RCPB andmust be quickly evaluated. Although the increase does notnecessarily violate the absolute unidentified LEAKAGE limit,certain susceptible components must be determined not to bethe source of the LEAKAGE increase within the requiredCompletion Time. For an unidentified LEAKAGE increasegreater than required limits, an alternative to reducingLEAKAGE increase to within limits (i.e., reducing theleakage rate such that the current rate is less than the"2 gpm increase in the previous 24 hours" limit; either byisolating the source or other possible methods) is toevaluate service sensitive type 304 and type 316 austeniticstainless steel piping that is subject to high stress orthat contains relatively stagnant or intermittent flowfluids and determine it is not the source of the increasedLEAKAGE. This type piping is very susceptible to IGSCC.

The 4 hour Completion Time is reasonable to properly reducethe LEAKAGE increase or verify the source before the reactormust be shut down without unduly jeopardizing plant safety.

C.] and C.2

If any Required Action and associated Completion Time ofCondition A or B is not met or if pressure boundary LEAKAGEexists, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to MODE 3 within 12 hours and to MODE 4 within

(continued)



BASES


36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant safety systems.


The RCS LEAKAGE is monitored by a variety of instrumentsdesigned to provide alarms when LEAKAGE is indicated and toquantify the various types of LEAKAGE. Leakage detectioninstrumentation is discussed in more detail in the Bases forLCO 3.4.5, "RCS Leakage Detection Instrumentation." Sumplevel and flow rate are typically monitored to determineactual LEAKAGE rates; however, any method may be used toquantify LEAKAGE within the guidelines of Reference 6. Inconjunction with alarms and other administrative controls, a4 hour Frequency for this Surveillance is appropriate foridentifying LEAKAGE and for tracking required trends(Ref. 7).

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).


4. GEAP-5620, "Failure Behavior in ASTM A106B PipesContaining Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, "Investigation and Evaluation ofCracking in Austenitic Stainless Steel Piping ofBoiling Water Reactors," October 1975.

6. Regulatory Guide 1.45, May 1973.

7. Generic Letter 88-01, "NRC Position on IGSCC in BWRAustenitic Stainless Steel Piping," January 1988.


RCS Leakage Detection InstrumentationB 3.4.5


B 3.4.5 RCS Leakage Detection Instrumentation

BASES

BACKGROUND UFSAR Safety Design Basis (Ref. I) requires means fordetecting and, to the extent practical, identifying thelocation of the source of RCS LEAKAGE. RegulatoryGuide 1.45 (Ref. 2) describes acceptable methods forselecting leakage detection systems.

Limits on LEAKAGE from the reactor coolant pressure boundary(RCPB) are required so that appropriate action can be takenbefore the integrity of the RCPB is impaired (Ref. 2).Leakage detection systems for the RCS are provided to alertthe operators when leakage rates above normal backgroundlevels are detected and also to supply quantitativemeasurement of leakage rates. The Bases for LCO 3.4.4, "RCSOperational LEAKAGE," discuss the limits on RCS LEAKAGErates.

Systems for separating the LEAKAGE of an identified sourcefrom an unidentified source are necessary to provide promptand quantitative information to the operators to permit themto take immediate corrective action.

LEAKAGE from the RCPB inside the drywell is detected by atleast one of two independently monitored variables, such assump level changes and drywell gaseous radioactivity levels.The primary means of quantifying LEAKAGE in-the drywell isthe drywell floor drain sump monitoring system.

The drywell floor drain sump monitoring system monitors theLEAKAGE collected in the floor drain sump. Thisunidentified LEAKAGE consists of LEAKAGE from control roddrives, valve flanges or packings, floor drains, the ReactorBuilding Closed Cooling Water System, and drywell aircooling unit condensate drains, and any LEAKAGE notcollected in the drywell equipment drain sump.

An alternate to the drywell floor drain sump monitoringsystem is the drywell equipment drain sump monitoringsystem, but only if the drywell floor drain sump isoverflowing. The drywell equipment drain sump collects notonly all leakage not collected in the drywell floor drainsump, but also any overflow from the drywell floor drainsump. Therefore, if the drywell floor drain sump is

(continued)



BASES


overflowing to the drywell equipment drain sump, the drywellequipment drain sump monitoring system can be used toquantify LEAKAGE. In this condition, all LEAKAGE measuredby the drywell equipment drain sump monitoring system isassumed to be unidentified LEAKAGE.

The floor drain sump level indicators have switches thatstart and stop the sump pumps when required. If the sumpfills to the high high level setpoint, an alarm sounds inthe control room, indicating a LEAKAGE rate into the sump inexcess of 50 gpm.

A flow transmitter in the discharge line of the drywellfloor drain sump pumps provides flow indication in thecontrol room. The pumps can also be started from thecontrol room.

The primary containment air monitoring system continuouslymonitors the primary containment atmosphere for airbornegaseous radioactivity. A sudden significant increase ofradioactivity, which may be attributed to RCPB steam orwater LEAKAGE, is annunciated in the control room. Theprimary containment atmosphere gaseous radioactivitymonitoring system is not capable of quantifying LEAKAGErates. Although the alarm setpoint is set in accordancewith Reference 3 to avoid receiving many unnecessary alarmsand the frequent resetting of the setpoint, the monitoringsystem is sensitive enough to indicate increased LEAKAGErates of 1 gpm within 1 hour. Larger changes in LEAKAGErates are detected in proportionally shorter times (Ref. 3).


A threat of significant compromise to the RCPB exists if thebarrier contains a crack that is large enough to propagaterapidly. LEAKAGE rate limits are set low enough to detectthe LEAKAGE emitted from a single crack in the RCPB (Refs. 4and 5). Each of the leakage detection systems inside thedrywell is designed with the capability of detecting LEAKAGEless than the established LEAKAGE rate limits. The allowedLEAKAGE rates are well below the rates predicted forcritical crack sizes (Ref. 6). Therefore, these actionsprovide adequate response before a significant break in theRCPB can occur.

RCS leakage detection instrumentation satisfies Criterion Iof the NRC Policy Statement.

(continued)



BASES (continued)

LCO The drywell sump monitoring system is required to quantifythe unidentified LEAKAGE from the RCS. Thus, for the systemto be considered OPERABLE, the system must be capable ofmeasuring reactor coolant leakage. This may be accomplishedby use of the associated drywell sump flow integrator, flowrecorder, or the pump curves and drywell sump pump out time.The system consists of a) the drywell floor drain sumpmonitoring system, or b) the drywell equipment drain sumpmonitoring system, but only when the drywell floor drainsump is overflowing. The other monitoring system providesearly alarms to the operators so closer examination of otherdetection systems will be made to determine the extent ofany corrective action that may be required. With theleakage detection systems inoperable, monitoring for LEAKAGEin the RCPB is degraded.

APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are requiredto be OPERABLE to support LCO 3.4.4. This Applicability isconsistent with that for LCO 3.4.4.

ACTIONS A.1

With the drywell sump monitoring system inoperable, no otherform of sampling can provide the equivalent information toquantify leakage. However, the primary containmentatmospheric radioactivity monitor will provide indication ofchanges in leakage.

With the drywell sump monitoring system inoperable,operation may continue for 24 hours. The 24 hour CompletionTime is acceptable, based on operating experience,considering no other method to quantify leakage isavailable.

B.1 and B.2

With the gaseous primary containment atmospheric monitoringchannel inoperable, grab samples of the primary containmentatmosphere must be taken and analyzed for gaseousradioactivity to provide periodic leakage information.Provided a sample is obtained and analyzed once every12 hours, the plant may be operated for up to 30 days toallow restoration of the required monitor.

(continuedl



BASES


The 12 hour interval provides periodic information that isadequate to detect LEAKAGE. The 30 day Completion Time forrestoration recognizes that at least one other form ofleakage detection is available.

C.1 and C.2

If any Required Action and associated Completion Time ofCondition A or B cannot be met, the plant must be brought toa MODE in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within12 hours and MODE 4 within 36 hours. The allowed CompletionTimes are reasonable, based on operating experience, toperform the actions in an orderly manner and withoutchallenging plant systems.

D.1

With all required monitors inoperable, no required automaticmeans of monitoring LEAKAGE are available, and immediateplant shutdown in accordance with LCO 3.0.3 is required.


This SR is for the performance of a CHANNEL CHECK of therequired primary containment atmospheric monitoring system.The check gives reasonable confidence that the channel isoperating properly. The Frequency of 12 hours is based oninstrument reliability and is reasonable for detecting offnormal conditions.

(continued)



BASES


(continued)

SR 3.4.5.2

This SR is for the performance of a CHANNEL FUNCTIONAL TESTof the required RCS leakage detection instrumentation. Thetest ensures that the monitors can perform their function inthe desired manner. The test also verifies the alarmsetpoint and relative accuracy of the instrument string.The Frequency of 31 days considers instrument reliability,and operating experience has shown it proper for detectingdegradation.

SR 3.4.5.3

This SR is for the performance of a CHANNEL CALIBRATION ofrequired leakage detection instrumentation channels. Thecalibration verifies the accuracy of the instrument string.

The Frequency is 92 days and operating experience has proventhis Frequency is acceptable.


2. Regulatory Guide 1.45, May 1973.


4. GEAP-5620, "Failure Behavior in ASTM A1O6B PipesContaining Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, "Investigation andCracking in Austenitic StainlessBoiling Water Reactors," October

Evaluation ofSteel Piping of1975.



RCS Specific ActivityB 3.4.6


B 3.4.6 RCS Specific Activity

BASES

BACKGROUND During circulation, the reactor coolant acquires radioactivematerials due to release of fission products from fuel leaksinto the reactor coolant and activation of corrosionproducts in the reactor coolant. These radioactivematerials in the reactor coolant can plate out in the RCS,and, at times, an accumulation will break away to spike thenormal level of radioactivity. The release of coolant duringa Design Basis Accident (DBA) could send radioactivematerials into the environment.

Limits on the maximum allowable level of radioactivity inthe reactor coolant are established to ensure that in theevent of a release of any radioactive material to theenvironment during a DBA, radiation doses are maintainedwithin the limits of 10 CFR 100 (Ref. 1).

This LCO contains the iodine specific activity limits. Theiodine isotopic activities per gram of reactor coolant areexpressed in terms of a DOSE EQUIVALENT 1-131. Theallowable level is intended to limit the 2 hour radiationdose to an individual at the site boundary to well withinthe 10 CFR 100 limit.


Analytical methods and assumptions involving radioactivematerial in the primary coolant are presented in the UFSAR(Ref. 2). The specific activity in the reactor coolant (thesource term) is an initial condition for evaluation of theconsequences of an accident due to a main steam line break(MSLB) outside containment. No fuel damage is postulated inthe MSLB accident, and the release of radioactive materialto the environment is assumed to end-when the main steamisolation valves (MSIVs) close completely.

This MSLB release forms the basis for determining offsitedoses (Ref. 2). The limits on the specific activity of theprimary coolant ensure that the 2 hour thyroid and wholebody doses at the site boundary, resulting from an MSLBoutside containment during steady state operation, will notexceed the dose guidelines of 10 CFR 100.

(continued)



BASES

APPLICABLE The limits on specific activity are values from a parametricSAFETY ANALYSES evaluation of typical site locations. These limits are

(continued) conservative because the evaluation considered morerestrictive parameters than for a specific site, such as thelocation of the site boundary and the meteorologicalconditions of the site.

RCS specific activity satisfies Criterion 2 of the NRCPolicy Statement.

LCO The specific iodine activity is limited to : 0.2 pCi/gm DOSEEQUIVALENT 1-131. This limit ensures the source termassumed in the safety analysis for the MSLB is not exceeded,so any release of radioactivity to the environment during anMSLB is well within the 10 CFR 100 limits.

APPLICABILITY In MODE I, and MODES 2 and 3 with any main steam line notisolated, limits on the primary coolant radioactivity areapplicable since there is an escape path for release ofradioactive material from the primary coolant to theenvironment in the event of an MSLB outside of primarycontainment.

In MODES 2 and 3 with the main steam lines isolated, suchlimits do not apply since an escape path does not exist. InMODES 4 and 5, no limits are required since the reactor isnot pressurized and the potential for leakage is reduced.

ACTIONS A.1 and A.2

When the reactor coolant specific activity exceeds the LCODOSE EQUIVALENT 1-131 limit, but is 5 4.0 pki/gm, samplesmust be analyzed for DOSE EQUIVALENT 1-131 at least onceevery 4 hours. In addition, the specific activity must berestored to the LCO limit within 48 hours. The CompletionTime of once every 4 hours is based on the time needed totake and analyze a sample. The 48 hour Completion Time torestore the activity level provides a reasonable time fortemporary coolant activity increases (iodine spikes) to becleaned up with the normal processing systems.

(continued)



BASES

ACTIONS A.1 and A.2. (continued)

A Note permits the use of the provisions of LCO 3.0.4.c.This allowance permits entry into the applicable MODE(S)while relying on the ACTIONS. This allowance is acceptabledue to the significant conservatism incorporated into thespecific activity limit, the low probability of an eventwhich is limiting due to exceeding this limit, and theability to restore transient specific activity excursionswhile the plant remains at, or proceeds to, power operation.

B.1, B.2.1, B.2.2.1, and B.2.2.2

If the DOSE EQUIVALENT 1-131 cannot be restored to • 0.2jiCi/gm within 48 hours, or if at any time it is > 4.0jiCi/gm, it must be determined at least once every 4 hoursand all the main steam lines must be isolated within12 hours. Isolating the main steam lines precludes thepossibility of releasing radioactive material to theenvironment in an amount that is more than a small fractionof the requirements of 10 CFR 100 during a postulated MSLBaccident.

Alternatively, the plant can be placed in MODE 3 within12 hours and in MODE 4 within 36 hours. This option isprovided for those instances when isolation of main steamlines is not desired (e.g., due to the decay heat loads).In MODE 4, the requirements of the LCO are no longerapplicable.

The Completion Time of once every 4 hours is the time neededto take and analyze a sample. The 12 hour Completion Timeis reasonable, based on operating experience, to isolate themain steam lines in an orderly manner and withoutchallenging plant systems. Also, the allowed CompletionTimes for Required Actions B.2.2.1 and B.2.2.2 for placingthe unit in MODES 3 and 4 are reasonable, based on operatingexperience, to achieve the required plant conditions fromfull power conditions in an orderly manner and withoutchallenging plant systems.

(continued)

0

PBAPS UNIT 2 B 3.4-3'1 Revision No. 52


BASES (continued)


This Surveillance is performed to ensure iodine remainswithin limit during normal operation. The 7 day Frequencyis adequate to trend changes in the iodine activity level.

This SR is modified by a Note that requires thisSurveillance to be performed only in MODE I because thelevel of fission products generated in other MODES is muchless.

REFERENCES 1. 10 CFR 100.11, 1973.



RHR Shutdown Cooling System-Hot ShutdownB 3.4.7


B 3.4.7 Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown

BASES

BACKGROUND Irradiated fuel in the shutdown reactor core generates heatduring the decay of fission products and increases thetemperature of the reactor coolant. This decay heat must beremoved to reduce the temperature of the reactor coolant tos 212"F. This decay heat removal is in preparation forperforming refueling or maintenance operations, or forkeeping the reactor in the Hot Shutdown condition.

The RHR System has two loops with each loop consisting oftwo motor driven pumps, two heat exchangers, and associatedpiping and valves. There are two RHR shutdown coolingsubsystems per RHR System loop. Both loops have a commonsuction from the same recirculation loop. The fourredundant, manually controlled shutdown cooling subsystemsof the RHR System provide decay heat removal. Each pumpdischarges the reactor coolant, after circulation throughthe respective heat exchanger, to the reactor via theassociated recirculation loop. The RHR heat exchangerstransfer heat to the High Pressure Service Water (HPSW)System. Any one of the four RHR shutdown cooling subsystemscan provide the required decay heat removal function.


Decay heat removal by operation of the RHR System in theshutdown cooling mode is not required for mitigation of anyevent or accident evaluated in the safety analyses. Decayheat removal is, however, an important safety function thatmust be accomplished or core damage could result. The RHRShutdown Cooling System meets Criterion 4 of the NRC PolicyStatement.

LCO Two RHR shutdown cooling subsystems are required to beOPERABLE, and when no recirculation pump is in operation,one shutdown cooling subsystem must be in operation. AnOPERABLE RHR shutdown cooling subsystem consists of oneOPERABLE RHR pump, one heat exchanger, a HPSW pump capableof providing cooling to the heat exchanger, and theassociated piping and valves. The two subsystems have acommon suction source and are allowed to have commondischarge piping. Since piping is a passive component that

(continued)



BASES

LCO(continued)

is assumed not to fail, it is allowed to be common to bothsubsystems. Each shutdown cooling subsystem is consideredOPERABLE if it can be manually aligned (remote or local) inthe shutdown cooling mode for removal of decay heat. InMODE 3, one RHR shutdown cooling subsystem can provide therequired cooling, but two subsystems are required to beOPERABLE to provide redundancy. Operation of one subsystemcan maintain or reduce the reactor coolant temperature asrequired. However, to ensure adequate core flow to allowfor accurate average reactor coolant temperature monitoring,nearly continuous operation is required.

Note 1 permits both required RHR shutdown cooling subsystemsand recirculation pumps to be shut down for a period of2 hours in an 8 hour period. Note 2 allows one required RHRshutdown cooling subsystem to be inoperable for up to2 hours for performance of Surveillance tests. These testsmay be on the affected RHR System or on some other plantsystem or component that necessitates placing the RHR Systemin an inoperable status during the performance. This ispermitted because the core heat generation can be low enoughand the heatup rate slow enough to allow some changes to theRHR subsystems or other operations requiring RHR flowinterruption and loss of redundancy.

APPLICABILITY In MODE 3 with reactor steam dome pressure below the RHRshutdown cooling isolation pressure (i.e., the actualpressure at which the RHR shutdown cooling isolationpressure setpoint clears) the RHR Shutdown Cooling Systemmust be OPERABLE and shall be operated in the shutdowncooling mode to remove decay heat to reduce or maintaincoolant temperature. Otherwise, a recirculation pump isrequired to be in operation.

In MODES I and 2, and in MODE 3 with reactor steam domepressure greater than or equal to the RHR shutdown coolingisolation pressure, this LCO is not applicable. Operationof the RHR System in the shutdown cooling mode is notallowed above this pressure because the RCS pressure mayexceed the design pressure of the shutdown cooling piping.Decay heat removal at reactor pressures greater than orequal to the RHR shutdown cooling isolation pressure istypically accomplished by condensing the steam in the maincondenser.

(continued)



BASES

APPLICABILITY Additionally, in MODE 2 below this pressure, the OPERABILITY(continued) requirements for the Emergency Core Cooling Systems (ECCS)

(LCO 3.5.1, "ECCS-Operating") do not allow placing the RHRshutdown cooling subsystem into operation.

The requirements for decay heat removal in MODES 4 and 5 arediscussed in LCO 3.4.8, "Residual Heat Removal (RHR)Shutdown Cooling System-Cold Shutdown"; LCO 3.9.7,"Residual Heat Removal (RHR)-High Water Level"; andLCO 3.9.8, "Residual Heat Removal (RHR)-Low Water Level."

ACTIONS

A Note has been provided to modify the ACTIONSrelated to RHR shutdown cooling subsystems. Section 1.3,Completion Times, specifies once a Condition has beenentered, subsequent divisions, subsystems, components orvariables expressed in the Condition, discovered to beinoperable or not within limits, will not result in separateentry into the Condition. Section 1.3 also specifiesRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable shutdown cooling subsystems provide appropriatecompensatory measures for separate inoperable shutdowncooling subsystems. As such, a Note has been provided thatallows separate Condition entry for each inoperable RHRshutdown cooling subsystem.

A.1, A.2, and A.3

With one required RHR shutdown cooling subsystem inoperablefor decay heat removal, except as permitted by LCO Note 2,the inoperable subsystem must be restored to OPERABLE statuswithout delay. In this condition, the remaining OPERABLEsubsystem can provide the necessary decay heat removal. The

(continued)



BASES

ACTIONS A.I, A.2, and A.3 (continued)

overall reliability is reduced, however, because a singlefailure in the OPERABLE subsystem could result in reducedRHR shutdown cooling capability. Therefore, an alternatemethod of decay heat removal must be provided.

With both required RHR shutdown cooling subsystemsinoperable, an alternate method of decay heat removal mustbe provided in addition to that provided for the initial RHRshutdown cooling subsystem inoperability. Thisre-establishes backup decay heat removal capabilities,similar to the requirements of the LCO. The 1 hourCompletion Time is based on the decay heat removal functionand the probability of a loss of the available decay heatremoval capabilities.

The required cooling capacity of the alternate method shouldbe ensured by verifying (by calculation or demonstration)its capability to maintain or reduce temperature. Decayheat removal by ambient losses can be considered as, orcontributing to, the alternate method capability. Alternatemethods that can be used include (but are not limited to)the Condensate/Main Steam Systems and the Reactor WaterCleanup System.

However, due to the potentially reduced reliability of thealternate methods of decay heat removal, it is also requiredto reduce the reactor coolant temperature to the point whereMODE 4 is entered.

B.I. B.2, and B.3

With no RHR shutdown cooling subsystem and no recirculationpump in operation, except as permitted by LCO Note 1,reactor coolant circulation by the RHR shutdown coolingsubsystem or recirculation pump must be restored withoutdelay.

Until RHR or recirculation pump operation is re-established,an alternate method of reactor coolant circulation must beplaced into service. This will provide the necessarycirculation for monitoring coolant temperature. The I hourCompletion Time is based on the coolant circulation functionand is modified such that the I hour is applicableseparately for each occurrence involving a loss of coolant

(continuedl



BASES

ACTIONS B.1, B.2, and B.3 (continued)

circulation. Furthermore, verification of the functioningof the alternate method must be reconfirmed every 12 hoursthereafter. This will provide assurance of continuedtemperature monitoring capability.

During the period when the reactor coolant is beingcirculated by an alternate method (other than by therequired RHR shutdown cooling subsystem or recirculationpump), the reactor coolant temperature and pressure must beperiodically monitored to ensure proper function of thealternate method. The once per hour Completion Time isdeemed appropriate.


This Surveillance verifies that one required RHR shutdowncooling subsystem or recirculation pump is in operation andcirculating reactor coolant. The required flow rate isdetermined by the flow rate necessary to provide sufficientdecay heat removal capability. The Frequency of 12 hours issufficient in view of other visual and audible indications @available to the operator for monitoring the RHR subsystemin the control room.

This Surveillance is modified by a Note allowing sufficienttime to align the RHR System for shutdown cooling operationafter clearing the pressure setpoint that isolates thesystem, or for placing a recirculation pump in operation.The Note takes exception to the requirements of theSurveillance being met (i.e., forced coolant circulation isnot required for this initial 2 hour period), which alsoallows entry into the Applicability of this Specification inaccordance with SR 3.0.4. since the Surveillance will not be"not met" at the time of entry into the Applicability.

REFERENCES None.


RHR Shutdown Cooling System-Cold ShutdownB 3.4.8


B 3.4.8 Residual Heat Removal (RHR) Shutdown Cooling System-Cold Shutdown

BASES

BACKGROUND Irradiated fuel in the shutdown reactor core generates heatduring the decay of fission products and increases thetemperature of the reactor coolant. This decay heat must beremoved to maintain the temperature of the reactor coolants 212"F. This decay heat removal is in preparation forperforming refueling or maintenance operations, or forkeeping the reactor in the Cold Shutdown condition.

The RHR System has two loops with each loop consisting oftwo motor driven pumps, two heat exchangers, and associatedpiping and valves. There are two RHR shutdown coolingsubsystems per RHR System loop. Both loops have a commonsuction from the same recirculation loop. The fourredundant, manually controlled shutdown cooling subsystemsof the RHR System provide decay heat removal. Each pumpdischarges the reactor coolant, after circulation throughthe respective heat exchanger; to the reactor via theassociated recirculation loop. The RHR heat exchangerstransfer heat to the High Pressure Service Water (HPSW)System. Any one of the four RHR shutdown cooling subsystemscan provide the requested decay heat removal function.

APPLICABLE Decay heat removal by operation of the RHR System in theSAFETY ANALYSES shutdown cooling mode is not required for mitigation of any

event or accident evaluated in the safety analyses. Decayheat removal is, however, an important safety function thatmust be accomplished or core damage could result. The RHRShutdown Cooling System meets Criterion 4 of the NRC PolicyStatement.

LCO Two RHR shutdown cooling subsystems are required to beOPERABLE, and when no recirculation pump is in operation,one RHR shutdown cooling subsystem must be in operation. AnOPERABLE RHR shutdown cooling subsystem consists of oneOPERABLE RHR pump, one heat exchanger, a HPSW pump capableof providing cooling to the heat exchanger, and theassociated piping and valves. The two subsystems have acommon suction source and are allowed to have commondischarge piping. Since piping is a passive component thatis assumed not to fail, it is allowed to be common to both

(continued)



BASES

LCO(continued)

subsystems. In MODE 4, the RHR cross tie valve(MO-2-10-020) may be opened (per LCO 3.5.2) to allow pumpsin one loop to discharge through the opposite recirculationloop to make a complete subsystem. In addition, the HPSWcross-tie valve may be opened to allow an HPSW pump in oneloop to provide cooling to a heat exchanger in the oppositeloop to make a complete subsystem. Additionally, eachshutdown cooling subsystem is considered OPERABLE if it canbe manually aligned (remote or local) in the shutdowncooling mode for removal of decay heat. In MODE 4, one RHRshutdown cooling subsystem can provide the required cooling,but two subsystems are required to be OPERABLE to provideredundancy. Operation of one subsystem can maintain orreduce the reactor coolant temperature as required.However, to ensure adequate core flow to allow for accurateaverage reactor coolant temperature monitoring, nearlycontinuous operation is required.

Note I permits both required RHR shutdown cooling subsystemsto be shut down for a period of 2 hours in an 8 hour period.Note 2 allows one required RHR shutdown cooling subsystem tobe inoperable for up to 2 hours for performance ofSurveillance tests. These tests may be on the affected RHRSystem or on some other plant system or component thatnecessitates placing the RHR System in an inoperable statusduring the performance. This is permitted because the coreheat generation can be low enough and the heatup rate slowenough to allow some changes to the RHR subsystems or otheroperations requiring RHR flow interruption and loss ofredundancy.

APPLICABILITY In MODE 4, the RHR Shutdown Cooling System must be OPERABLEand shall be operated in the shutdown cooling mode to removedecay heat to maintain coolant temperature below 212'F.Otherwise, a recirculation pump is required to be inoperation.

In MODES I and 2, and in MODE 3 with reactor steam domepressure greater than or equal to the RHR shutdown coolingisolation pressure, this LCO is not applicable. Operationof the RHR System in the shutdown cooling mode is notallowed above this pressure because the RCS pressure mayexceed the design pressure of the shutdown cooling piping.Decay heat removal at reactor pressures above the RHRshutdown cooling isolation pressure is typicallyaccomplished by condensing the steam in the main condenser.

(continued')



BASES

APPLICABILITY Additionally, in MODE 2 below this pressure, the OPERABILITY(continued) requirements for the Emergency Core Cooling Systems (ECCS)

(LCO 3.5.1, "ECCS-Operating") do not allow placing the RHRshutdown cooling subsystem into operation.

The requirements for decay heat removal in MODE 3 below theRHR shutdown cooling isolation pressure and in MODE 5 arediscussed in LCO 3.4.7, "Residual Heat Removal (RHR)Shutdown Cooling System-Hot Shutdown"; LCO 3.9.7, "ResidualHeat Removal (RHR)-High Water Level"; and LCO 3.9.8,"Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related toRHR shutdown cooling subsystems. Section 1.3, CompletionTimes, specifies once a Condition has been entered,subsequent divisions, subsystems, components or variablesexpressed in the Condition, discovered to be inoperable ornot within limits, will not result in separate entry intothe Condition. Section 1.3 also specifies Required Actionsof the Condition continue to apply for each additionalfailure, with Completion Times based on initial entry intothe Condition. However, the Required Actions for inoperableshutdown cooling subsystems provide appropriate compensatorymeasures for separate inoperable shutdown coolingsubsystems. As such, a Note has been provided that allowsseparate Condition entry for each inoperable RHR shutdowncooling subsystem.

A.1

With one of the two required RHR shutdown cooling subsystemsinoperable, except as permitted by.LCO Note 2, the remainingsubsystem is capable of providing the required decay heatremoval. However, the overall reliability is reduced.Therefore, an alternate method of decay heat removal must beprovided. With both required RHR shutdown coolingsubsystems inoperable, an alternate method of decay heatremoval must be provided in addition to that provided forthe initial RHR shutdown cooling subsystem inoperability.This re-establishes backup decay heat removal capabilities,similar to the requirements of the LCO. The I hourCompletion Time is based on the decay heat removal functionand the probability of a loss of the available decay heat

(continuedl



BASES

ACTIONS A.i (continued)

removal capabilities. Furthermore, verification of thefunctional availability of these alternate method(s) must bereconfirmed every 24 hours thereafter. This will provideassurance of continued heat removal capability.

The required cooling capacity of the alternate method shouldbe ensured by verifying (by calculation or demonstration)its capability to maintain or reduce temperature. Decayheat removal by ambient losses can be considered as, orcontributing to, the alternate method capability. Alternatemethods that can be used include (but are not limited to)the Condensate/Main Steam Systems (feed and bleed) and theReactor Water Cleanup Sy~tem.

B.1 and B.2

With no RHR shutdown cooling subsystem and no recirculationpump in operation, except as permitted by LCO Note 1, anduntil RHR or recirculation pump operation is re-established,an alternate method of reactor coolant circulation must beplaced into service. This will provide the necessary Vcirculation for monitoring coolant temperature. The I hourCompletion Time is based on the coolant circulation functionand is modified such that the 1 hour is applicableseparately for each occurrence involving a loss of coolantcirculation. Furthermore, verification of the functioningof the alternate method must be reconfirmed every 12 hoursthereafter. This will provide assurance of continuedtemperature monitoring capability.

During the period when the reactor coolant is beingcirculated by an alternate method (other than by therequired RHR shutdown cooling subsystem or recirculationpump), the reactor coolant temperature and pressure must beperiodically monitored to ensure proper function of thealternate method. The once per hour Completion Time isdeemed appropriate.

(continued)



BASES (continued)


This Surveillance verifies that one required RHR shutdowncooling subsystem or recirculation pump is in operation andcirculating reactor coolant. The required flow rate isdetermined by the flow rate necessary to provide sufficientdecay heat removal capability. The Frequency of 12 hours issufficient in view of other visual and audible indicationsavailable to the operator for monitoring the RHR subsystemin the control room.

REFERENCES None.


RCS P/T LimitsB 3.4.9


B 3.4.9 RCS Pressure and Temperature (P/T) Limits

BASES

BACKGROUND All components of the RCS are designed to withstand effectsof cyclic loads due to system pressure and temperaturechanges. These loads are introduced by startup (heatup) andshutdown (cooldown) operations, power transients, andreactor trips. This LCO limits the pressure and temperaturechanges during RCS heatup and cooldown, within the designassumptions and the stress limits for cyclic operation.

The Specification contains P/T limit curves for heatup,cooldown, and inservice leakage and hydrostatic testing, andalso limits the maximum rate of change of reactor coolanttemperature. The criticality curve provides limits for bothheatup and criticality.

Each P/T limit curve defines an acceptable region for normaloperation. The usual use of the curves is operationalguidance during heatup or cooldown maneuvering, whenpressure and temperature indications are monitored andcompared to the applicable curve to determine that operation Uis within the allowable region.

The LCO establishes operating limits that provide a marginto brittle failure of the reactor vessel and piping of thereactor coolant pressure boundary (RCPB). The vessel is thecomponent most subject to brittle failure. Therefore, theLCO limits apply to the vessel.

10 CFR 50, Appendix G (Ref. 1), requires the establishmentof P/T limits for material fracture toughness requirementsof the RCPB materials. Reference 1 requires an adequatemargin to brittle failure during normal operation, abnormaloperational transients, and system hydrostatic tests. Itmandates the use of the ASME Code, Section III, Appendix G(Ref. 2).

The actual shift in the RTWDT of the vessel material will beestablished periodically by removing and evaluating theirradiated reactor vessel material specimens, in accordancewith the UFSAR (Ref. 3) and Appendix H of 10 CFR 50(Ref. 4). The operating P/T limit curves will be adjusted,as necessary, based on the evaluation findings and therecommendations of Reference 5.

(continued)



BASES


The P/T limit curves are composite curves established bysuperimposing limits derived from stress analyses of thoseportions of the reactor vessel and head that are the mostrestrictive. At any specific pressure, temperature, andtemperature rate of change, one location within the reactorvessel will dictate the most restrictive limit. Across thespan of the P/T limit curves, different locations are morerestrictive, and, thus, the curves are composites of themost restrictive regions.

The heatup curve represents a different set of restrictionsthan the cooldown curve because the directions of thethermal gradients through the vessel wall are reversed. Thethermal gradient reversal alters the location of the tensilestress between the outer and inner walls.

The criticality limits include the Reference 1 requirementthat they be at least 40"F above the heatup curve or thecooldown curve and not lower than 60"F above the adjustedreference temperature of the reactor vessel material in theregion that is controlling (reactor vessel flange region).

The consequence of violating the LCO limits is that the RCShas been operated under conditions that can result inbrittle failure of the reactor pressure vessel, possiblyleading to a nonisolable leak or loss of coolant accident.In the event these limits are exceeded, an evaluation mustbe performed to determine the effect on the structuralintegrity of the RCPB components. ASME Code, Section XI,Appendix E (Ref. 6), provides a recommended methodology forevaluating an operating event that causes an excursionoutside the limits.


The P/T limits are not derived from Design Basis Accident(DBA) analyses. They are prescribed during normal operationto avoid encountering pressure, temperature, and temperaturerate of change conditions that might cause undetected flawsto propagate and cause nonductile failure of the reactorpressure vessel, a condition that is unanalyzed.References 7 and 8 approved the curves and limits specifiedin this section. Since the P/T limits are not derived fromany DBA, there are no acceptance limits related to the P/Tlimits. Rather, the P/T limits are acceptance limitsthemselves since they preclude operation in an unanalyzedcondition.

(continued)



BASES

APPLICABLE RCS P/T limits satisfy Criterion 2 of the NRC PolicySAFETY ANALYSES Statement.

(continued)

LCO The elements of this LCO are:

a. RCS pressure and temperature are within the limitsspecified in Figures 3.4.9-1 and 3.4.9-2, and heatupor cooldown rates are s 100"F during RCS heatup,cooldown, and inservice leak and hydrostatic testing;

b. The temperature difference between the reactor vesselbottom head coolant and the reactor pressure vessel(RPV) coolant is s 145"F during recirculation pumpstartup;

c. The temperature difference between the reactor coolantin the respective recirculation loop and in thereactor vessel is 5 50"F during recirculation pumpstartup;

d. RCS pressure and temperature are within thecriticality limits specified in Figure 3.4.9-3, priorto achieving criticality; and

e. The reactor vessel flange and the head flangetemperatures are > 70F when tensioning the reactorvessel head bolting studs.

These limits define allowable operating regions and permit alarge number of operating cycles while also providing a widemargin to nonductile failure.

The rate of change of temperature limits controls thethermal gradient through the vessel wall and is used asinput for calculating the heatup, cooldown, and inserviceleakage and hydrostatic testing P/T limit curves. Thus, theLCO for the rate of change of temperature restricts stressescaused by thermal gradients and also ensures the validity ofthe P/T limit curves.

(continued)



BASES

LCO(continued)

Violation of the limits places the reactor vessel outside ofthe bounds of the stress analyses and can increase stressesin other RCS components. The consequences depend on severalfactors, as follows:

a. The severity of the departure from the allowableoperating pressure temperature regime or the severityof the rate of change of temperature;

b. The length of time the limits were violated (longerviolations allow the temperature gradient in the thickvessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws inthe vessel material.

APPLICABILITY The potential for violating a P/T limit exists at all times.For example, P/T limit violations could result from ambienttemperature conditions that result in the reactor vesselmetal temperature being less than the minimum allowedtemperature for boltup. Therefore, this LCO is applicableeven when fuel is not loaded in the core.

ACTIONS A.1 and A.2

Operation outside the P/T limits while in MODES 1, 2, and 3must be corrected so that the RCPB is returned to acondition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency ofrestoring the parameters to within the analyzed range. Mostviolations will not be severe, and the activity can beaccomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation isrequired to determine if RCS operation can continue. Theevaluation must verify the RCPB integrity remains acceptableand must be completed if continued operation is desired.Several methods may be used, including comparison withpre-analyzed transients in the stress analyses, newanalyses, or inspection of the components.

ASME Code, Section XI, Appendix E (Ref. 6), may be used tosupport the evaluation. However, its use is restricted toevaluation of the vessel beltline.

(continued)



BASES


The 72 hour Completion Time is reasonable to accomplish theevaluation of a mild violation. More severe violations mayrequire special, event specific stress analyses orinspections. A favorable evaluation must be completed ifcontinued operation is desired.

Condition A is modified by a Note requiring RequiredAction A.2 be completed whenever the Condition is entered.The Note emphasizes the need to perform the evaluation ofthe effects of the excursion outside the allowable limits.Restoration alone per Required Action A.I is insufficientbecause higher than analyzed stresses may have occurred andmay have affected the RCPB integrity.

B.1 and B.2

If a Required Action and associated Completion Time ofCondition A are not met, the plant must be placed in a lowerMODE because either the RCS remained in an unacceptable P/Tregion for an extended period of increased stress, or asufficiently severe event caused entry into an unacceptableregion. Either possibility indicates a need for morecareful examination of the event, best accomplished with theRCS at reduced pressure and temperature. With the reducedpressure and temperature conditions, the possibility ofpropagation of undetected flaws is decreased.

Pressure and temperature are reduced by placing the plant inat least MODE 3 within 12 hours and in MODE 4 within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems.

C.1 and C.2

Operation outside the P/T limits in other than MODES 1, 2,and 3 (including defueled conditions) must be corrected sothat the RCPB is returned to a condition that has beenverified by stress analyses. The Required Action must beinitiated without delay and continued until the limits arerestored.

(continued)



BASES


Besides restoring the P/T limit parameters to within limits,an evaluation is required to determine if RCS operation isallowed. This evaluation must verify that the RCPBintegrity is acceptable and must be completed beforeapproaching criticality or heating up to > 212'F. Severalmethods may be used, including comparison with pre-analyzedtransients, new analyses, or inspection of the components.ASME Code, Section XI, Appendix E (Ref. 6), may be used tosupport the evaluation; however, its use is restricted toevaluation of the beltline.


Verification that operation is within limits is requiredevery 30 minutes when RCS pressure and temperatureconditions are undergoing planned changes. Plant proceduresspecify the pressure and temperature monitoring points to beused during the performance of this Surveillance. ThisFrequency is considered reasonable in view of the controlroom indication available to monitor RCS'status. Also,since temperature rate of change limits are specified inhourly increments, 30 minutes permits a reasonable time forassessment and correction of minor deviations.

Surveillance for heatup, cooldown, or inservice leakage andhydrostatic testing may be discontinued when the criteriagiven in the relevant plant procedure for ending theactivity are satisfied.

This SR has been modified with a Note that requires thisSurveillance to be performed only during system heatup andcooldown operations and inservice leakage and hydrostatictesting.

SR 3.4.9.2

A separate limit is used when the reactor is approachingcriticality. Consequently, the RCS pressure and temperaturemust be verified within the appropriate limits beforewithdrawing control rods that will make the reactorcritical.

(continued)



BASES

SURVEILLANCE SR 3.4.9.2 (continued)REQUIREMENTS Performing the Surveillance within 15 minutes before control

rod withdrawal for the purpose of achieving criticalityprovides adequate assurance that the limits will not beexceeded between the time of the Surveillance and the timeof the control rod withdrawal.

SR 3.4.9.3 and SR 3.4.9.4

Differential temperatures within the applicable limitsensure that thermal stresses resulting from the startup ofan idle recirculation pump will not exceed designallowances. In addition, compliance with these limitsensures that the assumptions of the analysis for the startupof an idle recirculation loop (Ref. 9) are satisfied.

Performing the Surveillance within 15 minutes beforestarting the idle recirculation pump provides adequateassurance that the limits will not be exceeded between thetime of the Surveillance and the time of the idle pumpstart.

An acceptable means of demonstrating compliance with thetemperature differential requirement in SR 3.4.9.4 is tocompare the temperatures of the operating recirculation loopand the idle loop.

SR 3.4.9.3 and SR 3.4.9.4 have been modified by a Note thatrequires the Surveillance to be met only in MODES 1, 2, 3,and 4. In MODE 5, the overall stress on limiting componentsis lower. Therefore, AT limits are not required. The Notealso states the SR is only required to be met during arecirculation pump startup, since this is when the stressesoccur.

SR 3.4.9.5, SR 3.4.9.6. and SR 3.4.9.7

Limits on the reactor vessel flange and head flangetemperatures are generally bounded by the other P/T limitsduring system heatup and cooldown. However, operationsapproaching MODE 4 from MODE 5 and in MODE 4 with RCStemperature less than or equal to certain specified valuesrequire assurance that these temperatures meet the LCOlimits.

(continued)



BASES

SURVEILLANCE SR 3.4.9.5. SR 3.4.9.6, and SR 3.4.9.7 (continued)REQUIREMENTS

The flange temperatures must be verified to be above thelimits 30 minutes before and while tensioning the vesselhead bolting studs to ensure that once the head is tensionedthe limits are satisfied. When in MODE 4 with RCStemperature : 80"F, 30 minute checks of the flangetemperatures are required because of the reduced margin tothe limits. When in MODE 4 with RCS temperature 5 100F,monitoring of the flange temperature is required every12 hours to ensure the temperature is within the limitsspecified.

The 30 minute Frequency reflects the urgency of maintainingthe temperatures within limits, and also limits the timethat the temperature limits could be exceeded. The 12 hourFrequency is reasonable based on the rate of temperaturechange possible at these temperatures.

SR 3.4.9.5 is modified by a Note that requires theSurveillance to be performed only when tensioning thereactor vessel head bolting studs. SR 3.4.9.6 is modifiedby a Note that requires the Surveillance to be initiated 30minutes after RCS temperature s 80°F in MODE 4. SR 3.4.9.7is modified by a Note that requires the Surveillance to beinitiated 12 hours after RCS temperature : 100'F in MODE 4.The Notes contained in these'SRs are necessary to specifywhen the reactor vessel flange and head flange temperaturesare required to be verified to be within the limitsspecified.

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code, Section III,Appendix G.

3. UFSAR, Section 4.2.6 and Appendix K.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

(continued)



BASES

REFERENCES 6. ASME, Boiler and Pressure Vessel Code, Section XI,(continued) Appendix E.

7. R.E. Martin (NRC) letter to G.A. Hunger (PECo),Amendment No. 153 to Facility Operating License No.DPR-44 for the Peach Bottom Atomic Power Station UnitNo. 2, dated October 25, 1989.

8. R.J. Clark (NRC) letter to G.J. Beck (PECo), AmendmentNos. 162 and 164 to Facility Operating License Nos.DPR-44 and DPR-56 for the Peach Bottom Atomic PowerStation Units Nos. 2 and 3, dated June 27, 1991.



Reactor Steam Dome PressureB 3.4.10


B 3.4.10 Reactor Steam Dome Pressure

BASES

BACKGROUND The reactor steam dome pressure is an assumed value in thedetermination of compliance with reactor pressure vesseloverpressure protection criteria and is also an assumedinitial condition of design basis accidents and transients.


The reactor steam dome pressure of • 1053 psig is aninitial condition of the vessel overpressure protectionanalysis of Reference 1. This analysis assumes an initialmaximum reactor steam dome pressure and evaluates theresponse of the pressure relief system, primarily thesafety/relief valves, during the limiting pressurizationtransient. The determination of compliance with theoverpressure criteria is dependent on the initial reactorsteam dome pressure; therefore, the limit on this pressureensures that the assumptions of the overpressure protectionanalysis are conserved. Reference 2 along with Reference 1assumes an initial reactor steam dome pressure for theanalysis of design basis accidents and transients used todetermine the limits for fuel cladding integrity (see Basesfor LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1%cladding plastic strain (see Bases for LCO 3.2.3, "LINEARHEAT GENERATION RATE (LHGR)").

Reactor steam dome pressure satisfies the requirements ofCriterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of< 1053 psig ensures the plant is operated within theassumptions of the reactor overpressure protection analysis.Operation above the limit may result in a transient responsemore severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure isrequired to be less than or equal to the limit. In theseMODES, the reactor may be generating significant steam andthe events which may challenge the overpressure limits arepossible.

(continued)


Reactor Steam Dome PressureB 3.4.10

BASES 0APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because

(continued) the reactor is shut down. In these MODES, the reactorpressure is well below the required limit, and noanticipated events will challenge the overpressure limits.

ACTIONS A.1

With the reactor steam dome pressure greater than the limit,prompt action should be taken to reduce pressure to belowthe limit and return the reactor to operation within thebounds of the analyses. The 15 minute Completion Time isreasonable considering the importance of maintaining thepressure within limits. This Completion Time also ensuresthat the probability of an accident occurring while pressureis greater than the limit is minimized.

B.1

If the reactor steam dome pressure cannot be restored towithin the limit within the associated Completion Time, theplant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought toat least MODE 3 within 12 hours. The allowed CompletionTime of 12 hours is reasonable, based on operatingexperience, to reach MODE 3 from full power conditions in anorderly manner and without challenging plant systems.


Verification that reactor steam dome pressure is : 1053 psigensures that the initial conditions of the reactoroverpressure protection analysis and design basis accidentsare met. Operating experience has shown the 12 hourFrequency to be sufficient for identifying trends andverifying operation within safety analyses assumptions.

REFERENCES 1. Letter G94-PEPR-002A, Peach Bottom Rerate ProjectOverpressure Analysis at LCO Dome Pressure, from G.V.Kumar (GE) to T.E. Shannon (PECo), January 18, 1994.



ECCS-OperatingB 3.5.1

B 3.5 EMERGENCY CORECOOLING (RCIC)

COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATIONSYSTEM

B 3.5.1 ECCS-Operating

BASES

BACKGROUND The ECCS are designed, in conjunction with the primary andsecondary containment, to limit the release of radioactivematerials to the environment following a loss of coolantaccident (LOCA). The ECCS uses two independent methods(flooding and spraying) to cool the core during a LOCA. TheECCS network consists of the High Pressure Coolant Injection(HPCI) System, the Core Spray (CS) System, the lowpressurecoolant injection (LPCI) mode of the Residual Heat Removal(RHR) System, and the Automatic Depressurization System(ADS). The suppression pool provides the required source ofwater for the ECCS. Although no credit is taken in thesafety analyses for the condensate storage tank (CST), it iscapable of providing a source of water for the HPCI and CSsystems.

On receipt of an initiation signal, ECCS pumps automaticallystart; simultaneously, the system aligns and the pumpsinject water, taken either from the CST or suppression pool,into the Reactor Coolant System (RCS) as RCS pressure isovercome by the discharge pressure of the ECCS pumps.Although the system is initiated, ADS action is delayed,allowing the operator to interrupt the timed sequence if thesystem is not needed. The HPCI pump discharge pressurealmost immediately exceeds that of the RCS, and the pumpinjects coolant into the vessel to cool the core. If thebreak is small, the HPCI System will maintain coolantinventory as well as vessel level while the RCS is stillpressurized. If HPCI fails, it is backed up by ADS incombination with LPCI and CS. In this event, the ADS timedsequence would be allowed to time out and open the selectedsafety/relief valves (S/RVs) depressurizing the RCS, thusallowing the LPCI and CS to overcome RCS pressure and injectcoolant into the vessel. If the break is large, RCSpressure initially drops rapidly and the LPCI and CS coolthe core.

Water from the break returns to the suppression pool whereit is used again and again. Water in the suppression poolis circulated through an RHR System heat exchanger cooled bythe High Pressure Service Water System. Depending on thelocation and size of the break, portions of the ECCS may be

(continued)



BASES

BACKGROUND ineffective; however,the overall design is effective in(continued) cooling the core regardless of the size or location of the

piping break.

All ECCS subsystems are designed to ensure that no singleactive component failure will prevent automatic initiationand successful operation of the minimum required ECCSequipment.

The CS System (Ref. 1) is composed of two independentsubsystems. Each subsystem consists of two 50% capacitymotor driven pumps, a spray sparger above the core, andpiping and valves to transfer water from the suppressionpool to the sparger. The CS System is designed to providecooling to the reactor core when reactor pressure is low.Upon receipt of an initiation signal, the CS pumps in bothsubsystems are automatically started (if offsite power isavailable, A and C pumps in approximately 13 seconds, and Band D pumps in approximately 23 seconds, and if offsitepower is not available, all pumps 6 seconds after AC poweris available). When the RPV pressure drops sufficiently, CSSystem flow to the RPV begins. A full flow test line isprovided to route water from and to the suppression pool toallow testing of the CS System without spraying water in theRPV.

LPCI is an independent operating mode of the RHR System.There are two LPCI subsystems (Ref. 2), each consisting oftwo motor driven pumps and piping and valves to transferwater from the suppression pool to the RPV via thecorresponding recirculation loop. The two LPCI pumps andassociated motor operated valves in each LPCI subsystem arepowered from separate 4 kV emergency buses. Both pumps in aLPCI subsystem inject water into the reactor vessel througha common inboard injection valve and depend on the closureof the recirculation pump discharge valve following a LPCIinjection signal. Therefore, each LPCI subsystems' commoninboard injection valve and recirculation pump dischargevalve is powered from one of the two 4 kV emergency busesassociated with that subsystem (normal source) and has thecapability for automatic transfer to the second 4 kVemergency bus associated with that LPCI subsystem. Theability to provide power to the inboard injection valve andthe recirculation pump discharge valve from either 4 kVemergency bus associated with the LPCI subsystem ensuresthat the single failure of a diesel generator (DG) will notresult in the failure of both LPCI pumps in one subsystem.

(continued)

PBAPS UNIT 2 .B 3.5-2 Revision No. 0

ECCS-Operati ngB 3.5.1

BASES


The two LPCI subsystems can be interconnected via the LPCIcross tie valve; however, the cross tie valve is maintainedclosed with its power removed to prevent loss of both LPCIsubsystems during a LOCA. The LPCI subsystems are designedto provide core cooling at low RPV pressure. Upon receiptof an initiation signal, all four LPCI pumps areautomatically started (if offsite power is available, A andB pumps in approximately 2 seconds and C and D pumps inapproximately 8 seconds, and, if offsite power is notavailable, all pumps immediately after AC power isavailable). Since one DG supplies power to an RHR pump inboth units, the RHR pump breakers are interlocked betweenunits to prevent operation of an RHR pump from both units onone DG and potentially overloading the affected DG. RHRSystem valves in the LPCI flow path are automaticallypositioned to ensure the proper flow path for water from thesuppression pool to inject into the recirculation loops.When the RPV pressure drops sufficiently, the LPCI flow tothe RPV, via the corresponding recirculation loop, begins.The water then enters the reactor through the jet pumps.Full flow test lines are provided for the four LPCI pumps toroute water to the suppression pool, to allow testing of theLPCI pumps without injecting water into the RPV. These testlines also provide suppression pool cooling capability, asdescribed in LCO 3.6.2.3, "RHR Suppression Pool Cooling."

The HPCI System (Ref. 3) consists of a steam driven turbinepump unit, piping, and valves to provide steam to theturbine, as well as piping and valves to transfer water fromthe suction source to the core via the feedwater systemline, where the coolant is distributed within the RPVthrough the feedwater sparger. Suction piping for thesystem is provided from the CST and the suppression pool.Pump suction for HPCI is normally aligned to the CST sourceto minimize injection of suppression pool water into theRPV. However, if the CST water supply is low, or if thesuppression pool level is high, an automatic transfer to thesuppression pool water source ensures a water supply forcontinuous operation of the HPCI System. The steam supplyto the HPCI turbine is piped from a main steam line upstreamof the associated inboard main steam isolation valve.

The HPCI System is designed to provide core cooling for awide range of reactor pressures (150 psig to 1150 psig,).Upon receipt of an initiation signal, the HPCI turbine stopvalve and turbine control valve open and the turbineaccelerates to a specified speed. As the HPCI flow

(continued)



BASES

BACKGROUND increases, the turbine governor valve is automatically(continued) adjusted to maintain design flow. Exhaust steam from the

HPCI turbine is discharged to the suppression pool. A fullflow test line is provided to route water back to the CST toallow testing of the HPCI System during normal operationwithout injecting water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines,which discharge to the suppression pool. The valves inthese lines automatically open to prevent pump damage due tooverheating when other discharge line valves are closed. Toensure rapid delivery of water to the RPV and to minimizewater hammer effects, all ECCS pump discharge lines arefilled with water. The LPCI and CS System discharge linesare kept full of water using a "keep fill" system. The HPCISystem is normally aligned to the CST. The height of waterin the CST is sufficient to maintain the piping full ofwater up to the first isolation valve. The relative heightof the feedwater line connection for HPCI is such that thewater in the feedwater lines keeps the remaining portion ofthe HPCI discharge line full of water. Therefore, HPCI doesnot require a "keep fill" system.

The Nuclear System Pressure Relief System consists of 2safety valves (SVs) and 11 safety/relief valves (S/RVs).The ADS (Ref. 4) consists of 5 of the 11 S/RVs. It isdesigned to provide depressurization of the RCS during asmall break LOCA if HPCI fails or is unable to maintainrequired water level in the RPV. ADS operation reduces theRPV pressure to within the operating pressure range of thelow pressure ECCS subsystems (CS and LPCI), so that thesesubsystems can provide coolant inventory makeup. Each ofthe S/RVs used for automatic depressurization is equippedwith one nitrogen accumulator and associated inlet checkvalves. The accumulator provides the pneumatic power toactuate the valves.

APPLICABLE The ECCS performance is evaluated for the entire spectrum ofSAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which

ECCS operation is required are presented in Reference 5.The required analyses and assumptions are defined inReference 6. The results of these analyses are described inReference 7.

(continued)


ECCS-Operati ngB 3.5.1

BASES

APPLICABLE This LCO helps to ensure that the following acceptanceSAFETY ANALYSES criteria for the ECCS,*established by 10 CFR 50.46 (Ref. 8),

(continued) will be met following a LOCA, assuming the worst case singleactive component failure in the ECCS:

a. Maximum fuel element cladding temperature is • 2200'F;

b. Maximum .cladding oxidation is • 0.17 times the totalcladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium waterreaction is • 0.01 times the hypothetical amount thatwould be generated if all of the metal in the claddingsurrounding the fuel, excluding the claddingsurrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 7.The remaining OPERABLE ECCS subsystems provide thecapability to adequately cool the core and prevent excessivefuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement.

LCO Each ECCS injection/spray subsystem and five ADS valves arerequired to be OPERABLE. The ECCS injection/spraysubsystems are defined as the two CS subsystems, the twoLPCI subsystems, and one HPCI System. The low pressure ECCSinjection/spray subsystems are defined as the two CSsubsystems and the two LPCI subsystems.

With less than the required number of ECCS subsystemsOPERABLE, the potential exists that during a limiting designbasis LOCA concurrent with the worst case single failure,the limits specified in Reference 8 could be exceeded. AllECCS subsystems must therefore be OPERABLE to satisfy thesingle failure criterion required by Reference 8.

As noted, LPCI subsystems may be considered OPERABLE duringalignment and operation for decay heat removal when below theactual RHR shutdown cooling isolation pressure in MODE 3, ifcapable of being manually realigned (remote or local) to the

(continued)



BASES

LCO(continued)

LPCI mode and not otherwise inoperable. Alignment andoperation for decay heat removal includes when the requiredRHR pump is not operating or when the system is realignedfrom or to the RHR shutdown cooling mode. This allowance isnecessary since the RHR System may be required to operate inthe shutdown cooling mode to remove decay heat and sensibleheat from the reactor. At these low pressures and decayheat levels, a reduced complement of ECCS subsystems shouldprovide the required core cooling, thereby allowingoperation of RHR shutdown cooling when necessary. One LPCIsubsystem shall be considered inoperable during alignmentand operation for Suppression Pool Cooling (one or bothloops) to ensure compliance to Reference 7 single failureanalyses (Ref. 11).

APPLICABILITY All ECCS subsystems are required to be OPERABLE duringMODES 1, 2, and 3, when there is considerable energy in thereactor core and core cooling would be required to preventfuel damage in the event of a break in the primary systempiping. In MODES 2 and 3, when reactor steam dome pressureis • 150 psig, HPCI is not required to be OPERABLE becausethe low pressure ECCS subsystems can provide sufficient flowbelow this pressure. In MODES 2 and 3, when reactor steamdome pressure is • 100 psig, ADS is not required to beOPERABLE. because the low pressure ECCS subsystems canprovide sufficient flow below this pressure. ECCSrequirements for MODES 4 and 5 are specified in LCO 3.5.2,"ECCS-Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to aninoperable HPCI subsystem. There is an increased riskassociated with entering a MODE or other specified conditionin the Applicability with an inoperable HPCI subsystem andthe provisions of LCO 3.0.4.b, which allow entry into a MODEor other specified condition in the Applicability with theLCO not met after performance of a risk assessmentaddressing inoperable systems and components, should not beapplied in this circumstance.

A.1

If any one low pressure ECCS injection/spray subsystem isinoperable, or if one LPCI pump in each subsystem isinoperable, all inoperable subsystems must be restored toOPERABLE status within 7 days (e.g., if one LPCI pump ineach subsystem is inoperable, both must be restored within7 days). In this Condition, the remaining OPERABLEsubsystems provide adequate core cooling during a LOCA.However, overall ECCS reliability is reduced, because asingle failure in one of the remaining OPERABLE subsystems,concurrent with a LOCA, may result in the ECCS not beingable to perform its intended safety function. The 7 dayCompletion Time is based on a reliability study (Ref. 9)that evaluated the impact on ECCS availability, assumingvarious components and subsystems were taken out of service.The results were used to calculate the average availabilityof ECCS equipment needed to mitigate the consequences of aLOCA as a function of allowed outage times (i.e., CompletionTimes).

(continued)



BASES


If the inoperable low pressure ECCS subsystem cannot berestored to OPERABLE status within the associated CompletionTime, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 12 hours and to MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.

C.1 and C.2

If the HPCI System is inoperable and the RCIC System isimmediately verified to be OPERABLE, the HPCI System must berestored-to OPERABLE status within 14 days. In thisCondition, adequate core cooling is ensured by theOPERABILITY of the redundant and diverse low pressure ECCSinjection/spray subsystems in conjunction with ADS. Also,the RCIC System will automatically provide makeup water atmost reactor operating pressures. Immediate verification ofRCIC OPERABILITY is therefore required when HPCI isinoperable. This may be performed as an administrativecheck by examining logs or other information to determine ifRCIC is out of service for maintenance or other reasons. Itdoes not mean to perform the Surveillances needed todemonstrate the OPERABILITY of the RCIC System. If theOPERABILITY of the RCIC System cannot be verifiedimmediately, however, Condition E must be immediatelyentered. If a single active component fails concurrent witha design basis LOCA, there is a potential, depending on thespecific failure, that the minimum required ECCS equipmentwill not be available. A 14 day Completion Time is based ona reliability study cited in Reference 9 and has been foundto be acceptable through operating experience.

D.] and D.2

If any one low pressure ECCS injection/spray subsystem isinoperable in addition to an inoperable HPCI System, theinoperable low pressure ECCS injection/spray subsystem orthe HPCI System must be restored to OPERABLE status within72 hours. In this Condition, adequate core cooling is

(continued)



BASES


ensured by the OPERABILITY of the ADS and the remaining lowpressure ECCS subsystems. However, the overall ECCSreliability is significantly reduced because a singlefailure in one of the remaining OPERABLE subsystemsconcurrent with a design basis LOCA may result in the ECCSnot being able to perform its intended safety function.Since both a high pressure system (HPCI) and a low pressuresubsystem are inoperable, a more restrictive Completion Timeof 72 hours is required to restore either the HPCI System orthe low pressure ECCS injection/spray subsystem to OPERABLEstatus. This Completion Time is based on a reliabilitystudy cited in Reference 9 and has been found to beacceptable through operating experience.

E.I and E.2

If any Required Action and associated Completion Time ofCondition C or D is not met, the plant must be brought to acondition in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within12 hours and reactor steam dome pressure reduced to: 150 psig within 36 hours. The allowed Completion Timesare reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.

F.1I

The LCO requires five ADS valves to be OPERABLE in order toprovide the ADS function. Reference 7 contains the resultsof an analysis that evaluated the effect of one ADS valvebeing out of service. Per this analysis, operation of onlyfour ADS valves will provide the required depressurization.However, overall reliability of the ADS is reduced, becausea single failure in the OPERABLE ADS valves could result ina reduction in depressurization capability. Therefore,operation is only allowed for a limited time. The 14 dayCompletion Time is based on a reliability study cited inReference 9 and has been found to be acceptable throughoperating experience.

(continued)



BASES

ACTIONS G.1 and G.2(continued)

If any one low pressure ECCS injection/spray subsystem isinoperable in addition to one inoperable ADS valve, adequatecore cooling is ensured by the OPERABILITY of HPCI and theremaining low pressure ECCS injection/spray subsystem.However, overall ECCS reliability is reduced because asingle active component failure concurrent with a designbasis LOCA could result in the minimum required ECCSequipment not being available. Since both a high pressuresystem (ADS) and a low pressure subsystem are inoperable, amore restrictive Completion Time of 72 hours is required torestore either the low pressure ECCS subsystem or the ADSvalve to OPERABLE status. This Completion Time is based ona reliability study cited in Reference 9 and has been foundto be acceptable through operating experience.

H.1 and H.2

If any Required Action and associated Completion Time ofCondition F or G is not met, or if two or more ADS valvesare inoperable, the plant must be brought to a condition inwhich the LCO does not apply. To achieve this status, theplant must be brought to at least MODE 3 within 12 hours andreactor steam dome pressure reduced to s 100 psig within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems.

1.1

When multiple ECCS subsystems are inoperable (for reasonsother than the second Condition of Condition A), as statedin Condition I, the plant is in a condition outside of theaccident analyses. Therefore, LCO 3.0.3 must be enteredimmediately.


The flow path piping has the potential to develop voids andpockets of entrained air. Maintaining the pump dischargelines of the HPCI System, CS System, and LPCI subsystemsfull of water ensures that the ECCS will perform properly,

(continued)



BASES


injecting its full capacity into the RCS upon demand. Thiswill also prevent a water hammer following an ECCSinitiation signal. An acceptable method of ensuring thatthe lines are full is to vent at the high points. Anacceptable method of ensuring the LPCI and CS Systemdischarge lines are full is to verify the absence of theassociated "keep fill" system accumulator alarms. The31 day Frequency is based on the gradual nature of voidbuildup in the ECCS piping, the procedural controlsgoverning system operation, and operating experience.

SR 3.5.1.2

Verifying the correct alignment for manual, power operated,and automatic valves in the ECCS flow paths providesassurance that the proper flow paths will exist for ECCSoperation. This SR does not apply to valves that arelocked, sealed, or otherwise secured in position since thesewere verified to be in the correct position prior tolocking, sealing, or securing. A valve that receives aninitiation signal is allowed to be in a nonaccident positionprovided the valvewill automatically reposition in theproper stroke time. This SR does not require any testing orvalve manipulation; rather, it involves verification thatthose valves capable of potentially being mispositioned arein the correct position. This SR does not apply to valvesthat cannot be inadvertently misaligned, such as checkvalves. For the HPCI System, this SR also includes thesteam flow path for the turbine and the flow controllerposition.

The 31 day Frequency of this SR was derived from theInservice Testing Program requirements for performing valvetesting at least once every 92 days. The Frequency of31 days is further justified because the valves are operatedunder procedural control and because improper valve positionwould only affect a single subsystem. This Frequency hasbeen shown to be acceptable through operating experience.

(continued)



BASES


(continued)

SR 3.5.1.3

Verification every 31 days that ADS nitrogen supply headerpressure is Ž 85 psig ensures adequate air pressure forreliable ADS operation. The accumulator on each ADS valveprovides pneumatic pressure for valve actuation. The designpneumatic supply pressure requirements for the accumulatorare such that, following a failure of the pneumatic supplyto the accumulator, at least two valve actuations can occurwith the drywell at 70% of design pressure (Ref. 10). TheECCS safety analysis assumes only one actuation to achievethe depressurization required for operation of the lowpressure ECCS. This minimum required pressure of Ž 85 psigis provided by the ADS instrument air supply. The 31 dayFrequency takes into consideration administrative controlsover operation of the air system and alarms for low airpressure.

SR 3.5.1.4

Verification every 31 days that the LPCI cross tie valve isclosed and power to its operator is disconnected ensuresthat each LPCI subsystem remains independent and a failureof the flow path in one subsystem will not affect the flowpath of the other LPCI subsystem. Acceptable methods ofremoving power to the operator include de-energizing breakercontrol power or racking out or removing the breaker. Ifthe LPCI cross tie valve is open or power has not beenremoved from the valve operator, both LPCI subsystems mustbe considered inoperable. The 31 day Frequency has been

(continued)



BASES


found acceptable, considering that these valves are understrict administrative controls that will ensure the valvescontinue to remain closed with either control or motivepower removed.

SR 3.5.1.5

Cycling the recirculation pump discharge valves through onecomplete cycle of full travel demonstrates that the valvesare mechanically OPERABLE and will close when required.Upon initiation of an automatic LPCI subsystem injectionsignal, these valves are required to be closed to ensurefull LPCI subsystem flow injection in the reactor via therecirculation jet pumps. De-energizing the valve in theclosed position will also ensure the proper flow path forthe LPCI subsystem. Acceptable methods of de-energizing thevalve include de-energizing breaker control power, rackingout the breaker or removing the breaker.

The specified Frequency is once during reactor startupbefore THERMAL POWER is > 25% RTP. However, this SR ismodified by a Note that states the Surveillance is onlyrequired to be performed if the last performance was morethan 31 days ago. Verification during reactor startup priorto reaching > 25% RTP is an exception to the normalInservice Testing Program generic valve cycling Frequency of92 days, but is considered acceptable due to thedemonstrated reliability of these valves. If the valve isinoperable and in the open position, the associated LPCIsubsystem must be declared inoperable.

SR 3.5.1.6

Verification every 61 days of the automatic transfer betweenthe normal and the alternate power source (4 kV emergencybus) for each LPCI subsystem inboard injection valve andeach recirculation pump discharge valve demonstrates that ACelectrical power will be available to operate these valvesfollowing loss of power to one of the 4 kV emergency buses.The ability to provide power to the inboard injection valveand the recirculation pump discharge valve from either 4 kVemergency bus associated with the LPCI subsystem ensuresthat the single failure of an DG will not result in the

(continued)



BASES


failure of both LPCI pumps in one subsystem. Therefore,failure of the automatic transfer capability will result inthe inoperability of the affected LPCI subsystem. The 61day Frequency has been found acceptable based on engineeringjudgment and operating experience.

SR 3.5.1.7, SR 3.5.1.8, and SR 3.5.1.9

The performance requirements of the low pressure ECCS pumpsare determined through application of the 10 CFR 50,Appendix K criteria (Ref. 6). This periodic Surveillance isperformed to verify that the ECCS pumps will develop theflow rates required by the respective analyses. The lowpressure ECCS pump flow rates ensure that adequate corecooling is provided to satisfy the acceptance criteria ofReference 8. The pump flow rates are verified against asystem head equivalent to the RPV pressure expected during aLOCA. The total system pump outlet pressure is adequate toovercome the elevation head pressure between the pumpsuction and the vessel discharge, the piping frictionlosses, and RPV pressure present during a LOCA. Thesevalues may be established by testing or analysis or duringpreoperational testing.

To avoid damaging CS System valves during testing,throttling is not normally performed to obtain a system headcorresponding to a reactor pressure of z 105 psig. As such,SR 3.5.1.7 is modified by a Note to allow use of pump curvesto determine equivalent values for flow rate and testpressure for the CS pumps in order to meet the SurveillanceRequirement. The Note allows baseline testing at a systemhead corresponding to a reactor pressure of z 105 psig to beused to determine an equivalent flow value at the normaltest pressure. This baseline testing is performed after anymodification or repair that could affect system flowcharacteristics.

The flow tests for the HPCI System are performed at twodifferent pressure ranges such that system capability toprovide rated flow is tested at both the higher and loweroperating ranges of the system. Additionally, adequatesteam flow must be passing through the main turbine orturbine bypass valves to continue to control reactor

(continued)


ECCS -OperatingB 3.5.1

BASES

SURVEILLANCE SR 3.5.1.7. SR 3.5.1.8, and SR 3.5.1.9 (continued)REQUIREMENTS

pressure when the HPCI System diverts steam flow. Reactorsteam pressure must be • 1053 and Ž 940 psig to performSR 3.5.1.8 and greater than or equal to the Electro-Hydraulic Control (EHC) System minimum pressure set with theEHC System controlling pressure (EHC System beginscontrolling pressure at a nominal 150 psig) and g 175 psigto perform SR 3.5.1.9. Adequate steam flow is representedby at least 2 turbine bypass valves open. Therefore,sufficient time is allowed after adequate pressure and floware achieved to perform these tests. Reactor startup isallowed prior to performing the low pressure Surveillancetest because the reactor pressure is low and the timeallowed to satisfactorily perform the Surveillance test isshort. The reactor pressure is allowed to be increased tonormal operating pressure since it is assumed that the lowpressure test has been satisfactorily completed and there isno indication or reason to believe that HPCI is inoperable.Therefore, SR 3.5.1.8 and SR 3.5.1.9 are modified by Notesthat state the Surveillances are not required to beperformed until 12 hours after the reactor steam pressureand flow are adequate to perform the test.

The 92 day-Frequency for SR 3.5.1.7 and SR 3.5.1.8 isconsistent with the Inservice Testing Program requirements.The 24 month Frequency for SR 3.5.1.9 is based on the needto perform the Surveillance under the conditions that applyjust prior to or during a startup from a plant outage.Operating experience has shown that these components willpass the SR when performed at the 24 month Frequency, whichis based on the refueling cycle. Therefore, the Frequencywas concluded to be acceptable from a reliabilitystandpoint.

SR 3.5.1.10

The ECCS subsystems are required to actuate automatically toperform their design functions. This Surveillance verifiesthat, with a required system initiation signal (actual orsimulated), the automatic initiation logic of HPCI, CS, andLPCI will cause the systems or subsystems to operate asdesigned, including actuation of the system throughout itsemergency operating sequence, automatic pump startup andactuation of all automatic valves to their requiredpositions. This SR also ensures that either the HPCI System

(continued)


ECCS -OperatingB 3.5.1

BASES


will automatically restart on an RPV low water level (Level2) signal received subsequent to an RPV high water level(Level 8) trip or, if the initial RPV low water level (Level2) signal was not manually reset, then the HPCI System willrestart when the RPV high water level (Level 8) tripautomatically clears, and that the suction is automaticallytransferred from the CST to the suppression pool. The LOGICSYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlapsthis Surveillance to provide complete testing of the assumedsafety function.

The 24 month Frequency is based on the need to perform theSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown that these components willpass the SR when performed at the 24 month Frequency, whichis based on the refueling cycle. Therefore, the Frequencywas concluded to be acceptable from a reliabilitystandpoint.

This SR is modified by a Note that excludes vesselinjection/spray during the Surveillance. Since all activecomponents are testable and full flow can be demonstrated byrecirculation through the test line, coolant injection intothe RPV is not required during the Surveillance.

SR 3.5.1.11

The ADS designated S/RVs are required to actuateautomatically upon receipt of specific initiation signals.A system functional test is performed to demonstrate thatthe mechanical portions of the ADS function (i.e.,solenoids) operate as designed when initiated either by anactual or simulated initiation signal, causing properactuation of all the required components. SR 3.5.1.12 andthe LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1overlap this Surveillance to provide complete testing of theassumed safety function.

The 24 month Frequency is based on the need to perform theSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown that these components will

(continued)


ECCS - OperatingB 3.5.1

BASES


pass the SR when performed at the 24 month Frequency, whichis based on the refueling cycle. Therefore, the Frequencywas concluded to be acceptable from a reliabilitystandpoint.

This SR is modified by a Note that excludes valve actuation.This prevents an RPV pressure blowdown.

SR 3.5.1.12

The pneumatic actuator of each ADS valve is stroked toverify that the second stage pilot disc rod is mechanicallydisplaced when the actuator strokes. Second stage pilot rodmovement is determined by the measurement of actuator rodtravel. The total amount of movement of the second stagepilot rod from the valve closed position to the openposition shall meet criteria established by the S/RVsupplier. SRs 3.3.5.1.5 and 3.5.1.11 overlap thisSurveillance to provide testing of the SRV depressurizationmode function.

Operating experience has shown that these components willpass the SR when performed at the 24 month Frequency, whichis based on the refueling cycle. Therefore, the Frequencywas concluded to be acceptable from a reliabilitystandpoint.

(continued)



BASES (continued)




4. UFSAR, Sections 4.4.5 and 6.4.2.


6. 10 CFR 50, Appendix K.

7. NEDC-32163P, "Peach Bottom Atomic Power Station Units2 and 3 SAFER/GESTR-LOCA Loss of Coolant AccidentAnalysis," January 1993.

8. 10 CFR 50.46.

9. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.(NRC), "Recommended Interim Revisions to LCOs for ECCSComponents," December 1, 1975.


11. Issue Report 189167, Operability of RHR while in TestModes/Torus Cooling.


ECCS-ShutdownB 3.5.2

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATIONCOOLING (RCIC) SYSTEM 0

B 3.5.2 ECCS-Shutdown

BASES

BACKGROUND A description of the Core Spray (CS) System and the lowpressure coolant injection (LPCI) mode of the Residual HeatRemoval (RHR) System is provided in the Bases for LCO 3.5.1,"ECCS-Operating."


The ECCS performance is evaluated for the entire spectrumof break sizes for a postulated loss of coolant accident(LOCA). The long term cooling analysis following a designbasis LOCA (Ref. 1) demonstrates that only one low pressureECCS injection/spray subsystem is required, post LOCA, tomaintain adequate reactor vessel water level in the event ofan inadvertent vessel draindown. It is reasonable toassume, based on engineering judgement, that while in MODES4 and 5 one low pressure ECCS injection/spray subsystem canmaintain adequate reactor vessel water level. To provideredundancy, a minimum of two low pressure ECCS injection/spray subsystems are required to be OPERABLE in MODES 4 Vand 5.

The low pressure ECCS subsystems satisfy Criterion 3 of theNRC Policy Statement.

LCO Two low pressure ECCS injection/spray subsystems arerequired to be OPERABLE. A low pressure ECCS injection/spray subsystem consists of a CS subsystem or a LPCIsubsystem. Each CS subsystem consists of two motor drivenpumps, piping, and valves to transfer water from thesuppression pool or condensate storage tank (CST) to thereactor pressure vessel (RPV). Each LPCI subsystem consistsof one motor driven pump, piping, and valves to transferwater from the suppression pool to the RPV. Only a singleLPCI pump is required per subsystem because of the largerinjection capacity in relation to a CS subsystem. InMODES 4 and 5, the LPCI cross tie valve is not required tobe closed. The necessary portions of the Emergency ServiceWater System are also required to provide appropriatecooling to each required ECCS subsystem.

(cnntinued'•(continued)



BASES

LCO(continued)

As noted, one LPCI subsystem may be considered OPERABLEduring alignment and operation for decay heat removal ifcapable of being manually realigned (remote or local) to theLPCI mode and is not otherwise inoperable. Alignment andoperation for decay heat removal includes when the requiredRHR pump is not operating or when the system is realignedfrom or to the RHR shutdown cooling mode. This allowance isnecessary since the RHR System may be required to operate inthe shutdown cooling mode to remove decay heat and sensibleheat from the reactor. Because of low pressure and lowtemperature conditions in MODES 4 and 5, sufficient timewill be available to manually align and initiate LPCIsubsystem operation to provide core cooling prior topostulated fuel uncovery.

APPLICABILITY OPERABILITY of the low pressure ECCS injection/spraysubsystems is required in MODES 4 and 5 to ensure adequatecoolant inventory and sufficient heat removal capability forthe irradiated fuel in the core in case of an inadvertentdraindown of the vessel. Requirements for ECCS OPERABILITYduring MODES 1, 2, and 3 are discussed in the Applicabilitysection of the Bases for LCO 3.5.1. ECCS subsystems are notrequired to be OPERABLE during MODE 5 with the spent fuelstorage pool gates removed., the water level maintained atŽ 458 inches above reactor pressure vessel instrument zero(20 ft 11 inches above the RPV flange), and no operationswith a potential for draining the reactor vessel (OPDRVs) inprogress. This provides sufficient coolant inventory toallow operator action to terminate the inventory loss priorto fuel uncovery in case of an inadvertent draindown.

The Automatic Depressurization System is not required to beOPERABLE during MODES 4 and 5 because the RPV pressure is• 100 psig, and the CS System and the LPCI subsystems canprovide core cooling without any depressurization of theprimary system.

The High Pressure Coolant Injection System is not requiredto be OPERABLE during MODES 4 and 5 since the low pressureECCS injection/spray subsystems can provide sufficient flowto the vessel.

ACTIONS A.1 and B.1

If any one required low pressure ECCS injection/spraysubsystem is inoperable, an inoperable subsystem must berestored to OPERABLE status in 4 hours. In this Condition,the remaining OPERABLE subsystem can provide sufficientvessel flooding capability to recover from an inadvertentvessel draindown. However, overall system reliability isreduced because a single failure in the remaining OPERABLE

(continued)


ECCS--ShutdownB 3.5.2

BASES

ACTIONS A.I and B.1 (continued)

subsystem concurrent with a vessel draindown could result inthe ECCS not being able to perform its intended function.The 4 hour Completion Time for restoring the required lowpressure ECCS injection/spray subsystem to OPERABLE statusis based on engineering judgment that considered theremaining available subsystem and the low probability of avessel draindown event.

With the inoperable subsystem not restored to OPERABLEstatus in the required Completion Time, action must beimmediately initiated to suspend OPDRVs to minimize theprobability of a vessel draindown and the subsequentpotential for fission product release. Actions mustcontinue until OPDRVs are suspended.

C.I. C.2, D.]. D.2.' and D.3

With both of the required ECCS injection/spray subsystemsinoperable, all coolant inventory makeup capability may beunavailable. Therefore, actions must immediately beinitiated to suspend OPDRVs to minimize the probability of avessel draindown and the subsequent potential for fissionproduct release. Actions must continue until OPDRVs aresuspended. One ECCS injection/spray subsystem must also berestored to OPERABLE status within 4 hours.

If at least one low pressure ECCS injection/spray subsystemis not restored to OPERABLE status within the 4 hourCompletion Time, additional actions are required to minimizeany potential fission product release to the environment.This includes ensuring secondary containment is OPERABLE;one standby gas treatment subsystem for Unit 2 is OPERABLE;and secondary containment isolation capability (i.e., oneisolation valve and associated instrumentation are OPERABLEor other acceptable administrative controls to assureisolation capability) in each associated secondarycontainment penetration flow path not isolated that isassumed to be isolated to mitigate radioactivity releases.OPERABILITY may be verified by an administrative check, orby examining logs or other information, to determine whetherthe components are out of service for maintenance or otherreasons. It is not necessary to perform the Surveillancesneeded to demonstrate the OPERABILITY of the components.

(continuedi



BASES

ACTIONS C.I. C.2. D.1. D.2. and D.3 (continued)

If, however, any required component is inoperable, then itmust be restored to OPERABLE status. In this case, theSurveillance may need to be performed to restore thecomponent to OPERABLE status. Actions must continue untilall required components are OPERABLE.

The 4 hour Completion Time to restore at least one lowpressure ECCS injection/spray subsystem to OPERABLE statusensures that prompt action will be taken to provide therequired cooling capacity or to initiate actions to placethe plant in a condition that minimizes any potentialfission product release to the environment.

SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2REQUIREMENTS

The minimum water level of 11.0 feet required for thesuppression pool is periodically verified to ensure that thesuppression pool will provide adequate net positive suctionhead (NPSH) for the CS System and LPCI subsystem pumps,recirculation volume, and vortex prevention. With thesuppression pool water level less than the required limit,all ECCS injection/spray subsystems are inoperable unlessthey are aligned to an OPERABLE CST.

When suppression pool level is < 11.0 feet, the CS System isconsidered OPERABLE only if it can take suction from theCST, and the CST water level is sufficient to provide therequired NPSH for the CS pump. Therefore, a verificationthat either the suppression pool water level is 2 11.0 feetor that CS is aligned to take suction from the CST and theCST contains Z 17.3 feet of water, equivalent to> 90,976 gallons of water, ensures that the CS System cansupply at least 50,000 gallons of makeup water to the RPV.The unavailable volume of the CST for CS is at the 40,976gallon level. However, as noted, only one required CSsubsystem may take credit for the CST option during OPDRVs.During OPDRVs, the volume in the CST may not provideadequate makeup if the RPV were completely drained.Therefore, only one CS subsystem is allowed to use the CST.This ensures the other required ECCS subsystem has adequatemakeup volume.

(continued)



BASES


The 12 hour Frequency of these SRs was developed consideringoperating experience related to suppression pool water leveland CST water level variations and instrument drift duringthe applicable MODES. Furthermore, the 12 hour Frequency isconsidered adequate in view of other indications availablein the control room to alert the operator to an abnormalsuppression pool or CST water level condition.

SR 3.5.2.3. SR 3.5.2.5, and SR 3.5.2.6

The Bases provided for SR 3.5.1.1, SR 3.5.1.7, andSR 3.5.1.10 are applicable to SR 3.5.2.3, SR 3.5.2.5, andSR 3.5.2.6, respectively.

SR 3.5.2.4

Verifying the correct alignment for manual, power operated,and automatic valves in the ECCS flow paths providesassurance that the proper flow paths will exist for ECCSoperation. This SR does not apply to valves that are 0locked, sealed, or-otherwise secured in position, sincethese valves were verified to be in the correct positionprior to locking, sealing, or securing. A valve thatreceives an initiation signal is allowed to be in anonaccident position provided the valve will automaticallyreposition in the proper stroke time. This SR does notrequire any testing or valve manipulation; rather, itinvolves verification that those valves capable ofpotentially being mispositioned are in the correct position.This SR does not apply to valves that cannot beinadvertently misaligned, such as check valves. The 31 dayFrequency is appropriate because the valves are operatedunder procedural control and the probability of their beingmispositioned during this time period is low.

(continued)



BASES

REFERENCES 1. NEDO-20566A, "General Electric Company AnalyticalModel for Loss-of-Coolant Accident Analysis inAccordance with 10 CFR 50 Appendix K," September 1986.


RCIC SystemB 3.5.3

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATIONCOOLING (RCIC) SYSTEM

B 3.5.3 RCIC System

BASES

BACKGROUND The RCIC System is not part of the ECCS; however, the RCICSystem is included with the ECCS section because of theirsimilar functions.

The RCIC System is designed to operate either automaticallyor manually following reactor pressure vessel (RPV)isolation accompanied by a loss of coolant flow from thefeedwater system to provide adequate core cooling andcontrol of the RPV water level. Under these conditions, theHigh Pressure Coolant Injection (HPCI) and RCIC systemsperform similar functions. The RCIC System designrequirements ensure that the criteria of Reference I aresatisfied.

The RCIC System (Ref. 2) consists of a steam driven turbinepump unit, piping, and valves to provide steam to theturbine, as well as piping and valves to transfer water fromthe suction source to the core via the feedwater systemline, where the coolant is distributed within the RPVthrough the feedwater sparger. Suction piping is providedfrom the condensate storage tank (CST) and the suppressionpool. Pump suction is normally aligned to the CST tominimize injection of suppression pool water into the RPV.However, if the CST water supply is low, an automatictransfer to the suppression pool water source ensures awater supply for continuous operation of the RCIC System.The steam supply to the turbine is piped from a main steamline upstream of the associated inboard main steam lineisolation valve.

The RCIC System is designed to provide core cooling for awide range of reactor pressures 150 psig to 1150 psig. Uponreceipt of an initiation signal, the RCIC turbineaccelerates to a specified speed. As the RCIC flowincreases, the turbine governor valve is automaticallyadjusted to maintain design flow. Exhaust steam from theRCIC turbine is discharged to the suppression pool. A fullflow test line is provided to route water back to the CST toallow testing of the RCIC System during normal operationwithout injecting water into the RPV.

(continued) J


RCIC SystemB 3.5.3

BASES


The RCIC pump is provided with a minimum flow bypass line,which discharges to the suppression pool. The valve in thisline automatically opens when the discharge line valves areclosed. To ensure rapid delivery of water to the RPV and tominimize water hammer effects, the RCIC System dischargepiping is kept full of water. The RCIC System is normallyaligned to the CST. The height of water in the CST issufficient to maintain the piping full of water up to thefirst isolation valve. The relative height of the feedwaterline connection for RCIC is such that the water in thefeedwater lines keeps the remaining portion of the RCICdischarge line full of water. Therefore, RCIC does notrequire a "keep fill" system.


The function of the RCIC System is to respond to transientevents by providing makeup coolant to the reactor. The RCICSystem is not an Engineered Safeguard System and no creditis taken in the safety analyses for RCIC System operation.Based on its contribution to the reduction of overall plantrisk, however, the system satisfies Criterion 4 of the NRCPolicy Statement.

LCO The OPERABILITY of the RCIC System provides adequate corecooling such that actuation of any of the low pressure ECCSsubsystems is not required in the event of RPV isolationaccompanied by a loss of feedwater flow. The RCIC Systemhas sufficient capacity for maintaining RPV inventory duringan isolation event.

APPLICABILITY The RCIC System is required to be OPERABLE during MODE 1,and MODES 2 and 3 with reactor steam dome pressure> 150 psig, since RCIC is the primary non-ECCS water sourcefor core cooling when the reactor is isolated andpressurized. In MODES 2 and 3 with reactor steam domepressure s 150 psig, and in MODES 4 and 5, RCIC is notrequired to be OPERABLE since the low pressure ECCSinjection/spray subsystems can provide sufficient flow tothe RPV.

(continued)


RCIC SystemB 3.5.3

BASES (continued)

ACTIONS A Note prohibits the application of LCO 3.0.4.b to aninoperable RCIC system. There is an increased riskassociated with entering a MODE or other specified conditionin the Applicability with an inoperable RCIC system and theprovisions of LCO 3.0.4.b, which allow entry into a MODE orother specified condition in the Applicability with the LCOnot met after performance of a risk assessment addressinginoperable systems and components, should not be applied inthis circumstance.

A.1 and A.2

If the RCIC System is inoperable during MODE 1, or MODE 2or 3 with reactor steam dome pressure > 150 psig, and theHPCI System is immediately verified to be OPERABLE, the RCICSystem must be restored to OPERABLE status within 14 days.In this Condition, loss of the RCIC System will not affectthe overall plant capability to provide makeup inventory athigh reactor pressure since the HPCI System is the only highpressure system assumed to function during a loss of coolantaccident (LOCA). OPERABILITY of HPCI is thereforeimmediately verified when the RCIC System is inoperable.This may be performed as an administrative check, byexamining logs or other information, to determine if HPCI isout of service for maintenance or other reasons. It doesnot mean it is necessary to perform the Surveillances neededto demonstrate the OPERABILITY of the HPCI System. If theOPERABILITY of the HPCI System cannot be verifiedimmediately, however, Condition B must be immediatelyentered. For certain transients and abnormal events with noLOCA, RCIC (as opposed to HPCI) is the preferred source ofmakeup coolant because of its relatively small capacity,which allows easier control of the RPV water level.Therefore, a limited time is allowed to restore theinoperable RCIC to OPERABLE status.

The 14 day Completion Time is based on a reliability study(Ref. 3) that evaluated the impact on ECCS availability,assuming various components and subsystems were taken out ofservice. The results were used to calculate the averageavailability of ECCS equipment needed to mitigate theconsequences of a LOCA as a function of allowed outage times(AOTs). Because of similar functions of HPCI and RCIC, theAOTs (i.e., Completion Times) determined for HPCI are alsoapplied to RCIC.

B.1 and B.2

If the RCIC System cannot be restored to OPERABLE statuswithin the associated Completion Time, or if the HPCI Systemis simultaneously inoperable, the plant must be brought to acondition in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within12 hours and reactor steam dome pressure reduced to

150 psig within 36 hours. The allowed Completion Times

(continued)


RCIC SystemB 3.5.3

BASES


are reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.


The flow path piping has the potential to develop voids andpockets of entrained air. Maintaining the pump dischargeline of the RCIC System full of water ensures that thesystem will perform properly, injecting its full capacityinto the Reactor Coolant System upon demand. This will alsoprevent a water hammer following an initiation signal. Anacceptable method of ensuring the line is full is to vent atthe high points. The 31 day Frequency is based on thegradual nature of void buildup in the RCIC piping, theprocedural controls governing system operation, andoperating experience.

SR 3.5.3.2

Verifying the correct alignment for manual, power operated,and automatic valves in the RCIC flow path providesassurance that the proper flow path will exist for RCICoperation. This SR does not apply to valves that arelocked, sealed, or otherwise secured in position since thesevalves were verified to be in the correct position prior tolocking, sealing, or securing. A valve that receives aninitiation signal is allowed to be in a nonaccident positionprovided the valve will automatically reposition in theproper stroke time. This SR does not require any testing orvalve manipulation; rather, it involves verification thatthose valves capable of potentially being mispositioned arein the correct position. This SR does not apply to valvesthat cannot be inadvertently misaligned, such as checkvalves. For the RCIC System, this SR also includes thesteam flow path for the turbine and the flow controllerposition.

(continued)


RCIC SystemB 3.5.3

BASES


*The 31 day Frequency of this SR was derived from theInservice Testing Program requirements for performing valvetesting at least once every 92 days. The Frequency of31 days is further justified because the valves are operatedunder procedural control and because improper valve positionwould affect only the RCIC System. This Frequency has beenshown to be acceptable through operating experience.

SR 3.5.3.3 and SR 3.5.3.4

The RCIC pump flow rates ensure that the system can maintainreactor coolant inventory during pressurized conditions withthe RPV isolated. The flow tests for the RCIC System areperformed at two different pressure ranges such that systemcapability to provide rated flow is tested both at thehigher and lower operating ranges of the system.Additionally, adequate steam flow must be passing throughthe main turbine or turbine bypass valves to continue tocontrol reactor pressure when the RCIC System diverts steamflow. Reactor steam pressure must be : 1053 and Ž 940 psigto perform SR 3.5.3.3 and greater than or equal to theElectro-Hydraulic Control (EHC) System minimum pressure setwith the EHC System controlling pressure (the EHC Systembegins controlling pressure at a nominal 150 psig) and• 175 psig to perform SR 3.5.3.4. Alternately, auxiliarysteam can be used to perform SR 3.5.3.4. Adequate steamflow is represented by at least 2 turbine bypass valvesopen. Therefore, sufficient time is allowed after adequatepressure and flow are achieved to perform these SRs.Reactor startup is allowed prior to performing the low.pressure Surveillance because the reactor pressure is lowand the time allowed to satisfactorily perform theSurveillance is short. Alternately, the low pressureSurveillance test may be performed prior to startup using anauxiliary steam supply. The reactor pressure is allowed tobe increased to normal operating pressure since it isassumed that the low pressure Surveillance has beensatisfactorily completed and there is no indication orreason to believe that RCIC is inoperable. Therefore, theseSRs are modified by Notes that state the Surveillances arenot required to *be performed until 12 hours after thereactor steam pressure and flow are adequate to perform thetest.

(continued)


RCIC SystemB 3.5.3

BASES


A 92 day Frequency for SR 3.5.3.3 is consistent with theInservice Testing Program requirements. The 24 monthFrequency for SR 3.5.3.4 is based on the need to perform theSurveillance under conditions that apply just prior to orduring startup from a plant outage. Operating experiencehas shown that these components will pass the SR whenperformed at the 24 month Frequency, which is based on therefueling cycle. Therefore, the Frequency was concluded tobe acceptable from a reliability standpoint.

SR 3.5.3.5

The RCIC System is required to actuate automatically inorder to verify its design function satisfactorily. ThisSurveillance verifies that, with a required systeminitiation signal (actual or simulated), the automaticinitiation logic of the RCIC System will cause.the system tooperate as designed, including actuation of the systemthroughout its emergency operating sequence; that is,automatic pump startup and actuation of all automatic valvesto their required positions. This test also ensures theRCIC System will automatically restart on an RPV low waterlevel (Level 2) signal received subsequent to an RPV highwater level (Level 8) trip and that the suction isautomatically transferred from the CST to the suppressionpool on low CST level. The LOGIC SYSTEM FUNCTIONAL TESTperformed in LCO 3.3.5.2 overlaps this Surveillance toprovide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform theSurveillance under the conditions that apply during a plantoutage and the potential for an unplanned transient if theSurveillance were performed with the reactor at power.Operating experience has shown that these components willpass the SR when performed at the 24 month Frequency, whichis based on the refueling cycle. Therefore, the Frequencywas concluded to be acceptable from a reliabilitystandpoint.

This SR is modified by a Note that excludes vessel injectionduring the Surveillance. Since all active components aretestable and full flow can be demonstrated by recirculationthrough the test line, coolant injection into the RPV is notrequired during the Surveillance.

(continued)


RCIC SystemB 3.5.3

BASES (continued)



3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.(NRC), "Recommended Interim Revisions to LCOs for ECCSComponents," December 1, 1975.


Primary ContainmentB 3.6.1.1


B 3.6.1.1 Primary Containment

BASES

BACKGROUND The function of the primary containment is to isolate andcontain fission products released from the Reactor PrimarySystem following a Design Basis Accident (DBA) and toconfine the postulated release of radioactive material. Theprimary containment consists of a steel vessel, whichsurrounds the Reactor Primary System and provides anessentially leak tight barrier against an uncontrolledrelease of radioactive material to the environment.Portions of the steel vessel are surrounded by reinforcedconcrete for shielding purposes.

The isolation devices for the penetrations in the primarycontainment boundary are a part of the containment leaktight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accidentconditions are either:

1. capable of being closed by an OPERABLE automaticContainment Isolation System, or

2. closed by manual valves, blind flanges, orde-activated automatic valves secured in theirclosed positions, except as provided inLCO 3.6.1.3, "Primary Containment IsolationValves (PCIVs)";

b. The primary containment air lock is OPERABLE, exceptas provided in LCO 3.6.1.2, "Primary Containment AirLock"; and

c. All equipment hatches are closed.

This Specification ensures that the performance of theprimary containment, in the event of a DBA, meets theassumptions used in the safety analyses of Reference 1.SR 3.6.1.1.1 leakage rate requirements are in conformancewith 10 CFR 50, Appendix J, Option B (Ref. 3), as modifiedby approved exemptions.

(continued)

PBAPS UNIT 2 B 3.6-1 Revision No. 2 7


BASES (continued)

APPLICABLE The safety design basis for the primary containment is thatSAFETY ANALYSES it must withstand the pressures and temperatures of the

limiting DBA without exceeding the design leakage rate.

The DBA that postulates the maximum release of radioactivematerial within primary containment is a LOCA. In theanalysis of this accident, it is assumed that primarycontainment is OPERABLE such that release of fissionproducts to the environment is controlled by the rate ofprimary containment leakage.

Analytical methods and assumptions involving the primarycontainment are presented in Reference 1. The safetyanalyses assume a nonmechanistic fission product releasefollowing a DBA, which forms the basis for determination ofoffsite doses. The fission product release is, in turn,based on an assumed leakage rate from the primarycontainment. OPERABILITY of the primary containment ensuresthat the leakage rate assumed in the safety analyses is notexceeded.

The maximum allowable leakage rate for the primarycontainment (L.) is 0.5% by weight of the containment airper 24 hours at the design basis LOCA maximum peakcontainment pressure (P,) of 49.1 psig. The value of P.(49.1 psig) is conservative with respect to the currentcalculated peak drywell pressure of 47.2 psig (Ref. 2).This value is 47.8 psig for operation with 90°F FinalFeedwater Temperature Reduction (Ref. 7).

Primary containment satisfies Criterion 3 of the NRC PolicyStatement.

LCO Primary containment OPERABILITY is maintained by limitingleakage to • 1.0 L., except prior to the first startup afterperforming a required Primary Containment Leakage RateTesting Program leakage test. At this time, applicableleakage limits must be met. In addition, the leakage fromthe drywell to the suppression chamber must be limited toensure the pressure suppression function is accomplished andthe suppression chamber pressure does not exceed designlimits. Compliance with this LCO will ensure a primarycontainment configuration, including equipment hatches, thatis structurally sound and that will limit leakage to thoseleakage rates assumed in the safety analyses.

(continued)



BASES

LCO Individual leakage rates specified for the primary(continued) containment air lock are addressed in LCO 3.6.1.2.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release ofradioactive material to primary containment. In MODES 4and 5, the probability and consequences of these events arereduced due to the pressure and temperature limitations ofthese MODES. Therefore, primary containment is not requiredto be OPERABLE in MODES 4 and 5 to prevent leakage ofradioactive material from primary containment.

ACTIONS

In the event primary containment is inoperable, primarycontainment must be restored to OPERABLE status withinI hour. The I hour Completion Time provides a period oftime to correct the problem commensurate with the importanceof maintaining primary containment OPERABILITY duringMODES 1, 2, and 3. This time period also ensures that theprobability of an accident (requiring primary containmentOPERABILITY) occurring during periods where primarycontainment is inoperable is minimal.

B.1 and B.2

If primary containment cannot be restored to OPERABLE statuswithin the required Completion Time, the plant must bebrought to a MODE in which the LCO does not apply. Toachieve this status, the plant must be brought to at leastMODE 3 within 12 hours and to MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.

SR 3.6.1.1.1

Maintaining the primary containment OPERABLE requirescompliance with the visual examinations and leakage ratetest requirements of the Primary Containment Leakage RateTesting Program. Failure to meet air lock leakage testing(SR 3.6.1.2.1), or main steam isolation


(continued')



BASES


valve leakage (SR 3.6.1.3.14), does not necessarily resultin a failure of this SR. The impact of the failure to meetthese SRs must be evaluated against the Type A, B, and Cacceptance criteria of the Primary Containment Leakage RateTesting Program. At : 1.0 L. the offsite dose consequencesare bounded by the assumptions of the safety analysis. TheFrequency is required by the Primary Containment LeakageRate Testing Program.

SR 3.6.1.1.2

Maintaining the pressure suppression function of primarycontainment requires limiting the leakage from the drywellto the suppression chamber. Thus, if an event were to occurthat pressurized the drywell, the steam would be directedthrough the downcomers into the suppression pool. This SRis a leak test that confirms that the bypass area betweenthe drywell and the suppression chamber is less than orequivalent to a one-inch diameter hole (Ref. 4). Thisensures that the leakage paths that would bypass thesuppression pool are within allowable limits.

The leakage test is performed every 24 months. The 24 month l

Frequency was developed considering that component failuresthat might have affected this test are identified by otherprimary containment SRs. Two consecutive test failures,however, would indicate unexpected primary containmentdegradation; in this event, as the Note indicates, a testshall be performed at a Frequency of once every 12 monthsuntil two consecutive tests pass, at which time the 24 monthtest Frequency may be resumed.

(continued)



BASES (continued)


2. Letter G94-PEPR-183, Peach Bottom Improved TechnicalSpecification Project Increased Drywell andSuppression Chamber Pressure Analytical Limits, fromG.V. Kumar (GE) to A.A. Winter (PECO), August 23,1994.

3. 10 CFR 50, Appendix J, Option B.

4. Safety Evaluation by the Office of Nuclear ReactorRegulation Supporting Amendment Nos. 127 and 130 toFacility Operating License Nos. DPR-44 and DPR-56,dated February 18, 1988.

5. NEI 94-01, Revision 0, "Industry Guideline forImplementing Performance-Based Option of 10 CFR Part50, Appendix J."

6. ANSI/ANS-56.8-1994, "Containment System LeakageTesting Requirements."

7. Peach Bottom Atomic Power Station Evaluation forExtended Final Feedwater Reduction, NEDC-32707P,Supplement 1, Revision 0, May, 1998.


Primary Containment Air LockB 3.6.1.2


B 3.6.1.2 Primary Containment Air Lock

BASES

BACKGROUND One double door primary containment air lock has been builtinto the primary containment to provide personnel access tothe drywell and to provide primary containment isolationduring the process of personnel entering and exiting thedrywell. The air lock is designed to withstand the sameloads, temperatures, and peak design internal and externalpressures as the primary containment (Ref. 1). As part ofthe primary containment, the air lock limits the release ofradioactive material to the environment during normal unitoperation and through a range of transients and accidents upto and including postulated Design Basis Accidents (DBAs).

Each air lock door has been designed and tested to certifyits ability to withstand a pressure in excess of the maximumexpected pressure following a DBA in primary containment.Each of the doors contains a gasket seal to ensure pressureintegrity. To effect a leak tight seal, the air lock designuses pressure seated doors (i.e., an increase in primarycontainment internal pressure results in increased sealingforce on each door).

Each air lock is nominally a right circular cylinder, 12 ftin diameter, with doors at each end that are interlocked toprevent simultaneous opening. During periods when primarycontainment is not required to be OPERABLE, the air lockinterlock mechanism may be disabled, allowing both doors ofan air lock to remain open for extended periods whenfrequent primary containment entry is necessary. Under someconditions as allowed by this LCO, the primary containmentmay be accessed through the air lock, when the interlockmechanism has failed, by manually performing the interlockfunction.

The primary containment air lock forms part of the primarycontainment pressure boundary. As such, air lock integrityand leak tightness are essential for maintaining primarycontainment leakage rate to within limits in the event of aDBA. Not maintaining air lock integrity or leak tightnessmay result in a leakage rate in excess of that assumed inthe unit safety analysis.

(continued)



BASES (continued)


The DBA that postulates the maximum release of radioactivematerial within primary containment is a LOCA. In theanalysis of this accident, it is assumed that primarycontainment is OPERABLE, such that release of fissionproducts to the environment is controlled by the rate ofprimary containment leakage. The primary containment isdesigned with a maximum allowable leakage rate (L.) of 0.5%by weight of the containment air per 24 hours at the maximumpeak containment pressure (P.) of 49.1 psig. The value of P.(49.1 psig) is conservative with respect to the currentcalculated peak drywell pressure of 47.2 psig (Ref. 3).This value is 47.8 psig for operation with 90*F FinalFeedwater Temperature Reduction (Ref. 4). This allowableleakage rate forms the basis for the acceptance criteriaimposed on the SRs associated with the air lock.

Primary containment air lock OPERABILITY is also required tominimize the amount of fission product gases that may escapeprimary containment through the air lock and contaminate andpressurize the secondary containment.

The primary containment air lock satisfies Criterion 3 ofthe NRC Policy Statement.

LCO As part of primary containment, the air lock's safetyfunction is related to control of containment leakage ratesfollowing a DBA. Thus, the air lock's structural integrityand leak tightness are essential to the successfulmitigation of such an event.

The primary containment air lock is required to be OPERABLE.For the air lock to be considered OPERABLE, the air lockinterlock mechanism must be OPERABLE, the air lock must bein compliance with the Type B air lock leakage test, andboth air lock doors must be OPERABLE. The interlock allowsonly one air lock door to be opened at a time. Thisprovision ensures that a gross breach of primary containmentdoes not exist when primary containment is required to beOPERABLE. Closure of a single door in each air lock issufficient to provide a leak tight barrier followingpostulated events. Nevertheless, both doors are kept closedwhen the air lock is not being used for normal entry andexit from primary containment.

(continued)



BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release ofradioactive material to primary containment. In MODES 4and 5, the probability and consequences of these events arereduced due to the pressure and temperature limitations ofthese MODES. Therefore, the primary containment air lock isnot required to be OPERABLE in MODES 4 and 5 to preventleakage of radioactive material from primary containment.

ACTIONS The ACTIONS are modified by Note 1, which allows entry andexit to perform repairs of the affected air lock component.If the outer door is inoperable, then it may be easilyaccessed to repair. If the inner door is the one that isinoperable, however, then a short time exists when thecontainment boundary is not intact (during access throughthe outer door). The ability to open the OPERABLE door,even if it means the primary containment boundary istemporarily not intact, is acceptable due to the lowprobability of an event that could pressurize the primarycontainment during the short time in which the OPERABLE dooris expected to be open. The OPERABLE door must beimmediately closed after each entry and exit.

The ACTIONS are modified by a second Note, which ensuresappropriate remedial measures are taken when necessary.Pursuant to LCO 3.0.6, actions are not required, even ifprimary containment leakage is exceeding La. Therefore, theNote is added to require ACTIONS for LCO 3.6.1.1, "PrimaryContainment," to be taken in this event.

A.I. A.2. and A.3

With one primary containment air lock door inoperable, theOPERABLE door must be verified closed (Required Action A.1)in the air lock. This ensures that a leak tight primarycontainment barrier is maintained by the use of an OPERABLEair lock door. This action must be completed within 1 hour.The I hour Completion Time is consistent with the ACTIONS ofLCO 3.6.1.1, which requires that primary containment berestored to OPERABLE status within 1 hour.

In addition, the air lock penetration must be isolated bylocking closed the OPERABLE air lock door within the 24 hourCompletion Time. The 24 hour Completion Time is considered

(continued)



BASES

ACTIONS A.1. A.2. and A.3 (continued)

reasonable for locking the OPERABLE air lock door,considering that the OPERABLE door is being maintainedclosed.

Required Action A.3 ensures that the air lock with aninoperable door has been isolated by the use of a lockedclosed OPERABLE air lock door. This ensures that anacceptable primary containment leakage boundary ismaintained. The Completion Time of once per 31 days isbased on engineering judgment and is considered adequate inview of the low likelihood of a locked door beingmispositioned and other administrative controls. RequiredAction A.3 is modified by a Note that applies to air lockdoors located in high radiation areas or areas with limitedaccess due to inerting and allows these doors to be verifiedlocked closed by use of administrative controls. Allowingverification by administrative controls is consideredacceptable, since access to these areas is typicallyrestricted. Therefore, the probability of misalignment ofthe door, once it has been verified to be in the properposition, is small.

The Required Actions have been modified by two Notes.Note 1 ensures that only the Required Actions and associatedCompletion Times of Condition-C are required if both doorsin the air lock are inoperable. With both doors in the airlock inoperable, an OPERABLE door is not available to beclosed. Required Actions C.1 and C.2 are the appropriateremedial actions. The exception of Note I does not affecttracking the Completion Time from the initial entry intoCondition A; only the requirement to comply with theRequired Actions. Note 2 allows use of the air lock forentry and exit for 7 days under administrative controls.Primary containment entry may be required to performTechnical Specifications (TS) Surveillances and RequiredActions, as well as other activities on TS-requiredequipment or activities on equipment that supportTS-required equipment. This Note is not intended topreclude performing other activities (i.e., non-TS-relatedactivities) if the primary containment was entered, usingthe inoperable air lock, to perform an allowed activitylisted above. The administrative controls required consistof the stationing of a dedicated individual to assureclosure of the OPERABLE door except during the entry andexit, and assuring the OPERABLE door is relocked after.

(continued)



BASES

ACTIONS A.]. A.2, and A.3 (continued)

completion of the containment entry and exit. Thisallowance is acceptable due to the low probability of anevent that could pressurize the primary containment duringthe short time that the OPERABLE door is expected to beopen.

B.]. B.2. and B.3

With an air lock interlock mechanism inoperable, theRequired Actions and associated Completion Times areconsistent with those specified in Condition A.

The Required Actions have been modified by two Notes.Note I ensures that only the Required Actions and associatedCompletion Times of Condition C are required if both doorsin the air lock are inoperable. With both doors in the airlock inoperable, an OPERABLE door is not available to beclosed. Required Actions C.1 and C.2 are the appropriateremedial actions. Note 2 allows entry into and exit fromthe primary containment under the control of a dedicatedindividual stationed at the air lock to ensure that only onedoor is opened at a time (i.e., the individual performs thefunction of the interlock).

Required Action B.3 is modified by a Note that applies toair lock doors located in high radiation areas or areas withlimited access due to inerting and that allows these doorsto be verified locked closed by use of administrativecontrols. Allowing verification by administrative controlsis considered acceptable, since access to these areas istypically restricted. Therefore, the probability ofmisalignment of the door, once it has been verified to be inthe proper position, is small.

C.]. C.2. and C.3

If the air lock is inoperable for reasons other than thosedescribed in Condition A or B, Required Action C.1 requiresaction to be immediately initiated to evaluate containmentoverall leakage rates using current air lock leakage testresults. An evaluation is acceptable since it is overlyconservative to immediately declare the primary containmentinoperable if the overall air lock leakage is not within

(continued)



BASES

ACTIONS C.I. C.2, and C.3 (continued)

limits. In many instances (e.g., only one seal per door hasfailed), primary-containment remains OPERABLE, yet only1 hour (according to LCO 3.6.1.1) would be provided torestore the air lock door to OPERABLE status prior torequiring a plant shutdown. In addition, even with theoverall air lock leakage not within limits, the overallcontainment leakage rate can still be within limits.

Required Action C.2 requires that one door in the primarycontainment air lock must be verified closed. This actionmust be completed within the 1 hour Completion Time. Thisspecified time period is consistent with the ACTIONS ofLCO 3.6.1.1, which require that primary containment berestored to OPERABLE status within 1 hour.

Additionally, the air lock must be restored to OPERABLEstatus within 24 hours. The 24 hour Completion Time isreasonable for restoring an inoperable air lock to OPERABLEstatus considering that at least one door is maintainedclosed in the air lock.

D.1 and 0.2

If the inoperable primary containment air lock cannot berestored to OPERABLE status within the associated CompletionTime, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 12 hours and to MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.


Maintaining primary containmnt air locks OPERABLE requirescompliance with the leakage rate test requirements of thePrimary Containment Leakage Rate Testing Program. This SRreflects the leakage rate testing requirements with respectto air lock leakage (Type B leakage tests). The acceptancecriteria were established during initial air lock andprimary containment OPERABILITY

(continued)



BASES


testing. The periodic testing requirements verify that theair lock leakage does not exceed the allowed fraction of theoverall primary containment leakage rate. The Frequency isrequired by the Primary Containment Leakage Rate TestingProgram.

The SR has been modified by two Notes. Note 1 states thatan inoperable air lock door does not invalidate the previoussuccessful performance of the overall air lock leakage test.This is considered reasonable since either air lock door iscapable of providing a fission product barrier in the eventof a DBA. Note 2 requires the results of air lock leakagetests to be evaluated against the acceptance criteria of thePrimary Containment Leakage Rate Testing Program, 5.5.12.This ensures that the air lock leakage is properly accountedfor in determining the combined Type B and C primarycontainment leakage.

SR 3.6.1.2.2

The air lock interlock mechanism is designed to preventsimultaneous opening of both doors in the air lock. Sinceboth the inner and outer doors of an air lock are designedto withstand the maximum expected post accident primarycontainment pressure, closure of either door will supportprimary containment OPERABILITY. Thus, the interlockfeature supports primary containment OPERABILITY while theair lock is being used for personnel transit in and out ofthe containment. Periodic testing of this interlockdemonstrates that the interlock will function as designedand that simultaneous inner and outer door opening will notinadvertently occur. Due to the purely mechanical nature ofthis interlock, and given that the interlock mechanism isnot normally challenged when primary containment is used forentry and exit (procedures require strict adherence tosingle door opening), this test is only required to beperformed every 24 months. The 24 month Frequency is basedon the need to perform this Surveillance under theconditions that apply during a plant outage, and thepotential for loss of primary containment OPERBILITY if theSurveillance were performed with the reactor at power.Operating experience has shown these components usually passthe Surveillance when performed at the 24 month Frequency.The 24 month Frequency is based on engineering judgment andis considered adequate given that the interlock is notchallenged during use of the airlock.

(continued)



BASES (continued)

REFERENCES 1. UFSAR, Section 5.2.3.4.5.


3. Letter G94-PEPR-183, Peach Bottom Improved TechnicalSpecification Project Increased Drywell andSuppression Chamber Pressure Analytical Limits, fromG.V. Kumar (GE) to A.A. Winter (PECo), August 23,1994.



PCIVsB 3.6.1.3


B 3.6.1.3 Primary Containment Isolation Valves (PCIVs)

BASES

BACKGROUND The function of the PCIVs, in combination with otheraccident mitigation systems, is to limit fission productrelease during and following postulated Design BasisAccidents (DBAs) to within limits. Primary containmentisolation within the time limits specified for thoseisolation valves designed to close automatically ensuresthat the release of radioactive material to the environmentwill be consistent with the assumptions used in the analysesfor a DBA.

The OPERABILITY requirements for PCIVs help ensure that anadequate primary containment boundary is maintained duringand after an accident by minimizing potential paths to theenvironment. Therefore, the OPERABILITY requirementsprovide assurance that primary containment function assumedin the safety analyses will be maintained. These isolationdevices are either passive or active (automatic). Closedmanual valves, de-activated automatic valves secured intheir closed position (including check valves with flowthrough the valve secured), blind flanges, and closedsystems are considered passive devices. Check valves andother automatic valves designed to close without operatoraction following an accident, are considered active devices.Two barriers in series are provided for each penetration sothat no single credible failure or malfunction of an activecomponent can result in a loss of isolation or leakage thatexceeds limits assumed in the safety analyses. One of thesebarriers may be a closed system.

The reactor building-to-suppression chamber vacuum breakersand the scram discharge volume vent and drain valves eachserve a dual function, one of which is primary containmentisolation. However, since the other safety functions of thevacuum breakers and the scram discharge volume vent anddrain valves would not be available if the normal PCIVactions were taken, the PCIV OPERABILITY requirements arenot applicable to the reactor building-to-suppressionchamber vacuum breaker valves and the scram discharge volumevent and drain valves. Similar Surveillance Requirements inthe LCO for the reactor building-to-suppression chambervacuum breakers and the LCO for the scram discharge volume

(continued) 0PBAPS UNIT 2 B 3.6-14 Revision No. 0

PCIVsB 3.6.1.3

BASES

BACKGROUND vent and drain valves provide assurance that the isolation(continued) capability is available without conflicting with the vacuum

relief or scram discharge volume vent and drain functions.

The primary containment purge lines are 18 inches indiameter; exhaust lines are 18 inches in diameter. Inaddition, a 6 inch line from the Containment AtmosphericControl (CAC) System is also provided to purge primarycontainment. The 6 and 18 inch primary containment purgevalves and the 18 inch primary containment exhaust valvesare normally maintained closed in MODES 1, 2, and 3 toensure the primary containment boundary is maintained.However, containment purging with the 18 inch purge andexhaust valves is permitted for inerting, de-inerting, andpressure control. Included in the scope of the de-inertingis the need to purge containment to ensure personnel safetyduring the performance of inspections beneficial to nuclearsafety; e.g., inspection of primary coolant integrity duringplant startups and shutdowns. Adjustments in primarycontainment pressure to perform tests such as the drywell-to-suppression chamber bypass leakage test are includedwithin the scope of pressure control purging. Purging forhumidity and temperature control using the 18 inch valves isexcluded. The isolation valves on the 18 inch vent lineshave 2 inch bypass lines around them for use during normalreactor operation when the 18 inch valves cannot be opened.Two additional redundant Standby Gas Treatment (SGT)isolation valves are provided on the vent line upstream ofthe SGT System filter trains. These isolation valves,together with the PCIVs, will prevent high pressure fromreaching the SGT System filter trains in the unlikely eventof a loss of coolant accident (LOCA) during venting.

The Safety Grade Instrument Gas (SGIG) System suppliespressurized nitrogen gas (from the Containment AtmosphericDilution (CAD) System liquid nitrogen storage tank) as asafety grade pneumatic source to the CAC System purge andexhaust isolation valve inflatable seals, the reactorbuilding-to-suppression chamber vacuum breaker air operatedisolation valves and inflatable seal, and the CAC and CADSystems vent control air operated valves. The SGIG Systemthus performs two distinct post-LOCA functions: (1)supports containment isolation and (2) supports CAD Systemvent operation. SGIG System requirements are addressed for

(continued)


PCIVs6.1.3B 3.

BASES


each of the supported system and components in LCO 3.6.1.3,"Primary Containment Isolation Valves (PCIVs)," LCO 3.6.1.5,"Reactor Building-to-Suppression Chamber Vacuum Breakers,"and LCO 3.6.3.1, "Containment Atmospheric Dilution (CAD)System." For the SGIG System, liquid nitrogen from the CADSystem liquid nitrogen storage tank passes through the CADSystem liquid nitrogen vaporizer where it is converted to agas. The gas then flows into a Unit 2 header and a Unit 3header separated by two manual globe valves. From eachheader, the gas then branches to each valve operator orvalve seal supplied by the SGIG System. Each branch isseparated from the header by a manual globe valve and acheck valve.

To support SGIG System functions, the CAD System liquidnitrogen storage tank minimum required level is a 16 incheswater column and a minimum required SGIG System headerpressure of 80 psig. Minimum requirements for the CADSystem liquid nitrogen storage tank to support CAD SystemOPERABILITY are specified in LCO 3.6.3.1, "ContainmentAtmospheric Dilution (CAD) System."


The PCIVs LCO was derived from the assumptions related tominimizing the loss of reactor coolant inventory, andestablishing the primary containment boundary during majoraccidents. As part of the primary containment boundary,PCIV OPERABILITY supports leak tightness of primarycontainment. Therefore, the safety analysis of any eventrequiring isolation of primary containment is applicable tothis LCO.

The DBAs that result in a release of radioactive materialand are mitigated by PCIVs are a LOCA and a main steam linebreak (MSLB). In the analysis for each of these accidents,it is assumed that PCIVs are either closed or close withinthe required isolation times following event initiation.This ensures that potential paths to the environment throughPCIVs (including primary containment purge valves) areminimized. Of the events analyzed in Reference 1, the LOCAis a limiting event due to radiological consequences. Theclosure time of the main steam isolation valves (MSIVs) isthe most significant variable from a radiologicalstandpoint. The MSIVs are required to close within 3 to5 seconds after signal generation. Likewise, it is assumedthat the primary containment is isolated such that releaseof fission products to the environment is controlled.

(continued)


PCIVsB 3.6.1.3

BASES

APPLICABLE The DBA analysis assumes that within 60 seconds of theSAFETY ANALYSES accident, isolation of the primary containment is complete

(continued) and leakage is terminated, except for the maximum allowableleakage rate, L . The primary containment isolation totalresponse time of 60 seconds includes signal delay, dieselgenerator startup (for loss of offsite power), and PCIVstroke times.

The single failure criterion required to be imposed in theconduct of unit safety analyses was considered in theoriginal design of the primary containment purge and exhaustvalves. Two valves in series on each purge and exhaust lineprovide assurance that both the supply and exhaust linescould be isolated even if a single failure occurred.

PCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO PCIVs form a part of the primary containment boundary. ThePCIV safety function is related to minimizing the loss ofthe reactor coolant inventory and establishing the primarycontainment boundary during a DBA.

The power operated, automatic isolation valves are requiredto have isolation times within limits and actuate on anautomatic isolation signal. In addition, for the CAC Systempurge and exhaust isolation valves to be consideredOPERABLE, the SGIG System supplying nitrogen gas to theinflatable seals of the valves must be OPERABLE. While thereactor building-to-suppression chamber vacuum breakers andthe scram discharge volume vent and drain valves isolateprimary containment penetrations, they are excluded fromthis Specification. Controls on their isolation functionare adequately addressed in LCO 3.1.8, "Scram DischargeVolume (SDV) Vent and Drain Valves," and LCO 3.6.1.5,"Reactor Building-to-Suppression Chamber Vacuum Breakers."The valves covered by this LCO are listed with theirassociated stroke times in Reference 2. The required stroketime is the stroke time listed in Reference 2 or theInservice Testing Program which ever is more conservative.

The normally closed PCIVs are considered OPERABLE whenmanual valves are closed or open in accordance withappropriate administrative controls, automatic valves are

(continued)


PCIVsB 3.6.1.3

BASES 0LCO

(continued)de-activated and secured in their closed position, blindflanges are in place, and closed systems are intact. Thesepassive isolation valves and devices are those listed inReference 2 and Reference 5.I

MSIVs must meet additional leakage rate requirements. OtherPCIV leakage rates are addressed by LCO 3.6.1.1, "PrimaryContainment," as Type B or C testing.

This LCO provides assurance that the PCIVs will performtheir designed safety functions to minimize the loss ofreactor coolant inventory and establish the primarycontainment boundary during accidents.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release ofradioactive material to primary containment. In MODES 4and 5, the probability and consequences of these events arereduced due to the pressure and temperature limitations ofthese MODES. Therefore, most PCIVs are not required to beOPERABLE and the primary containment purge and exhaustvalves are not required to be normally closed in MODES 4and 5. Certain valves, however, are required to be OPERABLE lto prevent inadvertent reactor vessel draindown. Thesevalves are those whose associated instrumentation isrequired to be OPERABLE per LCO 3.3.6.1, "PrimaryContainment Isolation Instrumentation." (This does notinclude the valves that isolate the associatedinstrumentation.)

ACTIONS The ACTIONS are modified by a Note allowing penetration flowpath(s) except for purge or exhaust valve flow path(s) to beunisolated intermittently under administrative controls.These controls consist of stationing a dedicated operator atthe controls of the valve, who is in continuouscommunication with the control room. In this way, thepenetration can be rapidly isolated when a need for primarycontainment isolation is indicated. Due to the size of theprimary containment purge line penetration and the fact thatthose penetrations exhaust directly from the containmentatmosphere to the environment, the penetration flow pathcontaining these valves is not allowed to be operated underadministrative controls.

(continued'

PBAPS UNIT 2 -B 3.6-18 Revision No. 2

PCIVsB 3.6.1.3

BASES

ACTIONS A second Note has been added to provide clarification that,(continued) for the purpose of this LCO, separate Condition entry is

allowed for each penetration flow path. This is acceptable,since the Required Actions for each Condition provideappropriate compensatory actions for each inoperable PCIV.Complying with the Required Actions may allow for continuedoperation, and subsequent inoperable PCIVs are governed bysubsequent Condition entry and application of associatedRequired Actions.

The ACTIONS are modified by Notes 3 and 4. Note 3 ensuresthat appropriate remedial actions are taken, if necessary,if the affected system(s) are rendered inoperable by aninoperable PCIV (e.g., an Emergency Core Cooling Systemssubsystem is inoperable due to a failed open test returnvalve). Note 4 ensures appropriate remedial actions aretaken when the primary containment leakage limits areexceeded. Pursuant to LCO 3.0.6, these actions would not berequired even when the associated LCO is not met.Therefore, Notes 3 and 4 are added to require the properactions be taken.

A.1 and A.2

With one or more penetration flow paths with one PCIVinoperable except for MSIV leakage not within limit, theaffected penetration flow paths must be isolated. Themethod of isolation must include the use of at least oneisolation barrier that cannot be adversely affected by asingle active failure. Isolation barriers that meet thiscriterion are a closed and de-activated automatic valve, aclosed manual valve, a blind flange, and a check valve withflow through the valve secured. For a penetration isolatedin accordance with Required Action A.1, the device used toisolate the penetration should be the closest availablevalve to the primary containment. The Required Action mustbe completed within the 4 hour Completion Time (8 hours formain steam lines). The Completion Time of 4 hours isreasonable considering the time required to isolate thepenetration and the relative importance of supportingprimary containment OPERABILITY during MODES 1, 2, and 3.For main steam lines, an 8 hour Completion Time is allowed.The Completion Time of 8 hours for the main steam lines

(continued)


PCIVsB 3.6.1.3

BASES


allows a period of time to restore the MSIVs to OPERABLEstatus given the fact that MSIV closure will result inisolation of the main steam line(s) and a potential forplant shutdown.

For affected penetrations that have been isolated inaccordance with Required Action A.1, the affectedpenetration flow path(s) must be verified to be isolated ona periodic basis. This is necessary to ensure that primarycontainment penetrations required to be isolated followingan accident, and no longer capable of being automaticallyisolated, will be in the isolation position should an eventoccur. This Required Action does not require any testing ordevice manipulation. Rather, it involves verification thatthose devices outside containment and capable of potentiallybeing mispositioned are in the correct position. TheCompletion Time of "once per 31 days for isolation devicesoutside primary containment" is appropriate because thedevices are operated under administrative controls and theprobability of their misalignment is low. For the devicesinside primary containment, the time period specified "priorto entering MODE 2 or 3 from MODE 4, if primary containmentwas de-inerted while in MODE 4, if not performed within theprevious 92 days" is based on engineering judgment and isconsidered reasonable in view of the inaccessibility of thedevices and other administrative controls ensuring thatdevice misalignment is an unlikely possibility.

Condition A is modified by a Note indicating that thisCondition is only applicable to those penetration flow pathswith two PCIVs. For penetration flow paths with one PCIV,Condition C provides the appropriate Required Actions.Required Action A.2 is modified by two Notes. Note 1 appliesto isolation devices located in high radiation areas, andallows them to be verified by use of administrative means.Allowing verification by administrative means is consideredacceptable, since access to these areas is typicallyrestricted. Note 2 applies to isolation devices that arelocked, sealed, or otherwise secured in position and allowsthese devices to be verified closed by use of administrativemeans. Allowing verification by administrative means isconsidered acceptable, since the function of locking,sealing, or securing components is to ensure that thesedevices are not inadvertently repositioned. Therefore, theprobability of misalignment, once they have been verified tobe in the proper position, is low.

(continued)


PCIVsB 3.6.1.3

BASES


With one or more penetration flow paths with two PCIVsinoperable except due to MSIV leakage not within limit,either the inoperable PCIVs must be restored to OPERABLEstatus or the affected penetration flow path must beisolated within 1 hour. The method of isolation mustinclude the use of at least one isolation barrier thatcannot be adversely affected by a single active failure.Isolation barriers that meet this criterion are a closed andde-activated automatic valve, a closed manual valve, and ablind flange. The 1 hour Completion Time is consistent withthe ACTIONS of LCO 3.6.1.1.

Condition B is modified by a Note indicating this Conditionis only applicable to penetration flow paths with two PCIVs.For penetration flow paths with one PCIV, Condition Cprovides the appropriate Required Actions.

C.1 and C.2

With one or more penetration flow paths with one PCIVinoperable, the inoperable valve must be restored toOPERABLE status or the affected penetration flow path mustbe isolated. The method of isolation must include the useof at least one isolation barrier that cannot be adverselyaffected by a single active failure. Isolation barriersthat meet this criterion are a closed and de-activatedautomatic valve, a closed manual valve, and a blind flange.A check valve may not be used to isolate the affectedpenetration. The Completion Time of 4 hours is reasonableconsidering the time required to isolate the penetration andthe relative importance of supporting primary containmentOPERABILITY during MODES 1, 2, and 3. The Completion Timeof 72 hours for penetrations with a closed system isreasonable considering the relative stability of the closedsystem (hence, reliability) to act as a penetrationisolation boundary and the relative importance of supportingprimary containment OPERABILITY during MODES 1, 2, and 3.The closed system must also meet the requirements ofReference 6. The Completion Time of 72 hours is alsoreasonable considering the instrument and the small pipediameter of penetration (hence, reliability) to act as apenetration isolation boundary and the small pipe diameterof the affected penetrations.

For affected penetrations that have been isolated inaccordance with Required Action C.1, the affectedpenetration flow path(s) must be verified to be isolated on

(continued)


PCIVsB 3.6.1.3

BASES


a periodic basis. This is necessary to ensure that primarycontainment penetrations required to be isolated followingan accident, and no longer capable of being automaticallyisolated, will be in the isolation position should an eventoccur. This Required Action does not require any testing orvalve manipulation. Rather, it involves verification,through a system walkdown, that those valves outsidecontainment and capable of potentially being mispositionedare in the correct position. The Completion Time of "onceper 31 days for isolation devices outside primarycontainment" is appropriate because the valves are operatedunder administrative controls and the probability of theirmisalignment is low. For the valves inside primarycontainment, the time period specified "prior to enteringMODE 2 or 3 from MODE 4, if primary containment wasde-inerted while in MODE 4, if not performed within theprevious 92 days" is based on engineering judgment and isconsidered reasonable in view of the inaccessibility of thevalves and other administrative controls ensuring that valvemisalignment is an unlikely possibility.

Condition C is modified by a Note indicating that thisCondition is only applicable to penetration flow paths withonly one PCIV. For penetration flow paths with two PCIVs,Conditions A and B provide the appropriate Required Actions.

Required Action C.2 is modified by two Notes. Note 1 appliesto valves and blind flanges located in high radiation areasand allows them to be verified by use of administrativemeans. Allowing verification by administrative means isconsidered acceptable, since access to these areas istypically restricted. Note 2 applies to isolation devicesthat are locked, sealed, or otherwise secured in position andallows these devices to be verified closed by use ofadministrative means. Allowing verification byadministrative means is considered acceptable, since thefunction of locking, sealing, or securing components is toensure that these devices are not inadvertently repositioned.Therefore, the probability of misalignment of these valves,once they have been verified to be in the proper position, islow.

D.1

With any MSIV leakage rate not within limit, the assumptionsof the safety analysis are not met. Therefore, the leakagemust be restored to within limit within 8 hours.Restoration can be accomplished by isolating the penetrationthat caused the limit to be exceeded by use of one closedand de-activated automatic valve, closed manual valve, orblind flange. When a penetration is isolated, the leakage

(continued)


PCIVsB 3.6.1.3

BASES


rate for the isolated penetration is assumed to be theactual pathway leakage through the isolation device. If twoisolation devices are used to isolate the penetration, theleakage rate is assumed to be the lesser actual pathwayleakage of the two devices. The 8 hour Completion Time isreasonable considering the time required to restore theleakage by isolating the penetration, the fact that MSIVclosure will result in isolation of the main steam line anda potential for plant shutdown, and the relative importanceof MSIV leakage to the overall containment function.

E.] and E.2

If any Required Action and associated Completion Time cannotbe met in MODE 1, 2, or 3, the plant must be brought to aMODE in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within12 hours and to MODE 4 within 36 hours. The allowedCompletion Times are reasonable, based on operatingexperience, t.o reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.

F.] and F.2

If any Required Action and associated Completion Time cannotbe met for PCIV(s) required to be OPERABLE during MODE 4 or5, the unit must be placed in a condition in which the LCOdoes not apply. Action must be immediately initiated tosuspend operations with a potential for draining the reactorvessel (OPDRVs) to minimize the probability of a vesseldraindown and subsequent potential for fission productrelease. Actions must continue until OPDRVs are suspendedand valve(s) are restored to OPERABLE status. If suspendingan OPDRV would result in closing the residual heat removal(RHR) shutdown cooling isolation valves, an alternativeRequired Action is provided to immediately initiate actionto restore the valve(s) to OPERABLE status. This allows RHRto remain in service while actions are being taken torestore the valve.

(continued)


PCIVsB 3.6.1.3

BASES (continued)

SURVEILLANCE SR 3.6.1.3.1REQUI REMENTS Verifying that the level in the CAD liquid nitrogen tank is

ý!16 inches water column will ensure at least 7 days ofpost-LOCA SGIG System operation. This minimum volume ofliquid nitrogen allows sufficient time after an accident toreplenish the nitrogen supply in order to maintain thecontainment isolation function. The level is verified every24 hours to ensure that the system is capable of performingits intended isolation function when required. The 24 hourFrequency is based on operating experience, which has shownto be an acceptable period to verify liquid nitrogen supply.The 24 hour Frequency also signifies the importance of theSGIG System for maintaining the containment isolationfunction of the primary containment purge and exhaustvalves.

SR 3.6.1.3.2

This SR ensures that the pressure in the SGIG System headeris ; 80 psig. This ensures that the post-LOCA nitrogenpressure provided to the valve operators and valve seals isadequate for the SGIG System to perform its design function.The 24 hour Frequency was developed considering theimportance of the SGIG System for maintaining thecontainment isolation function. The 24 hour Frequency isalso considered to be adequate to ensure timely detection ofany breach in the SGIG System which would render the systemincapable of performing its isolation function.

SR 3.6.1.3.3

This SR ensures that the primary containment purge andexhaust valves are closed as required or, if open, open foran allowable reason. If a purge valve is open in violationof this SR, the valve is considered inoperable (Condition Aapplies). The SR is modified by a Note stating that the SRis not required to be met when the purge and exhaust valvesare open for the stated reasons. The Note states that thesevalves may be opened for inerting, de-inerting, pressurecontrol, ALARA or air quality considerations for personnelentry, or Surveillances that require the valves to be open.The 6 inch and 18 inch purge valves and 18 inch exhaust

(continued}


PCIVsB 3.6.1.3

BASES


valves are capable of closing in the environment following aLOCA. Therefore, these valves are allowed to be open forlimited periods of time. The 31 day Frequency is consistentwith other PCIV requirements discussed in SR 3.6.1.3.4.

SR 3.6.1.3.4

This SR verifies that each primary containment isolationmanual valve and blind flange that is located outsideprimary containment and is not locked, sealed, or otherwisesecured and is required to be closed during accidentconditions is closed. The SR helps to ensure that postaccident leakage of radioactive fluids or gases outside theprimary containment boundary is within design limits.

This SR does not require any testing or valve manipulation.Rather, it involves verification that those PCIVs outsideprimary containment, and capable of being mispositioned, arein the correct position. Since verification of valveposition for PCIVs outside primary containment is relativelyeasy, the 31 day Frequency was chosen to provide addedassurance that the PCIVs are in the correct positions. ThisSR does not apply to valves that are locked, sealed, orotherwise secured in the closed position, since these valveswere verified to be in the correct position upon locking,sealing, or securing.

Three Notes have been added to this SR. The first Noteallows valves and blind flanges located in high radiationareas to be verified by use of administrative controls.Allowing verification by administrative controls isconsidered acceptable since the primary containment isinerted and access to these areas is typically restrictedduring MODES 1, 2, and 3 for ALARA reasons. Therefore, theprobability of misalignment of these PCIVs, once they havebeen verified to be in the proper position, is low. Asecond Note has been included to clarify that PCIVs that areopen under administrative controls are not required to meetthe SR during the time that the PCIVs are open. A thirdNote states that performance of the SR is not required fortest taps with a diameter • 1 inch. It is the intent thatthis SR must still be met, but actual performance is notrequired for test taps with a diameter • 1 inch. The Note 3allowance is consistent with the original plant licensingbasis.

(continued)


PCIVsB 3.6.1.3

BASES


(continued)

SR 3.6.1.3.5

This SR verifies that each primary containment manualisolation valve and blind flange that is located insideprimary containment and not locked, sealed, or otherwisesecured and is required to be closed during accidentconditions is closed. The SR helps to ensure that postaccident leakage of radioactive fluids or gases outside theprimary containment boundary is within design limits. ForPCIVs inside primary containment, the Frequency defined as"prior to entering MODE 2 or 3 from MODE 4 if primarycontainment was de-inerted while in MODE 4, if not performedwithin the previous 92 days" is appropriate since thesePCIVs are operated under administrative controls and theprobability of their misalignment is low. This SR does notapply to valves that are locked, sealed, or otherwisesecured in the closed position, since these valves wereverified to be in the correct position upon locking,sealing, or securing.

Two Notes have been added to this SR. The first Note allowsvalves and blind flanges located in high radiation areas tobe verified by use of administrative controls. Allowingverification by administrative controls is consideredacceptable since the primary containment is inerted andaccess to these areas is typically restricted duringMODES 1, 2, and 3 for ALARA reasons. Therefore, theprobability of misalignment of these PCIVs, once they havebeen verified to be in their proper position, is low. Asecond Note has been included to clarify that PCIVs that areopen under administrative controls are not required to meetthe SR during the time that the PCIVs are open.

SR 3.6.1.3.6

The traversing incore probe (TIP) shear isolation valves areactuated by explosive charges. Surveillance of explosivecharge continuity provides assurance that TIP valves willactuate when required. Other administrative controls, suchas those that limit the shelf life of the explosive charges,must be followed. The 31 day Frequency is based onoperating experience that has demonstrated the reliabilityof the explosive charge continuity.

SR 3.6.1.3.7

Verifying the correct alignment for each manual valve in theSGIG System required flow paths provides assurance that theproper flow paths exist for system operation. This SR doesnot apply to valves that are locked or otherwise secured in

(continued)


PCIVsB 3.6.1.3

BASES


position, since these valves were verified to be in thecorrect position prior to locking or securing. This SR doesnot require any testing or valve manipulation; rather, itinvolves verification that those valves capable of beingmispositioned are in the correct position. This SR does notapply to valves that cannot be inadvertently misaligned,such as check valves. The 31 day Frequency is based onengineering judgment, is consistent with the proceduralcontrols governing valve operation, and ensures correctvalve positions.

SR 3.6.1.3.8

Verifying the isolation time of each power operatedautomatic PCIV is within limits is required to demonstrateOPERABILITY. MSIVs may be excluded from this SR since MSIVfull closure isolation time is demonstrated by SR 3.6.1.3.9.The isolation time test ensures that the valve will isolatein a time period less than or equal to that assumed in thesafety analyses. The isolation time is in accordance withReference 2 or the requirements of the Inservice TestingProgram which ever is more conservative. The Frequency ofthis SR is in accordance with the requirements of theInservice Testing Program.

SR 3.6.1.3.9

Verifying that the isolation time of each MSIV is within thespecified limits is required to demonstrate OPERABILITY.The isolation time test ensures that the MSIV will isolatein a time period that does not exceed the times assumed inthe DBA analyses. This ensures that the calculatedradiological consequences of these events remain within10 CFR 100 limits. The Frequency of this SR is inaccordance with the requirements of the Inservice TestingProgram.

SR 3.6.1.3.10

Automatic PCIVs close on a primary containment isolationsignal to prevent leakage of radioactive material fromprimary containment following a DBA. This SR ensures thateach automatic PCIV will actuate to its isolation positionon a primary containment isolation signal. The LOGIC SYSTEM

(continued)


PCIVsB 3.6.1.3

BASES


FUNCTIONAL TEST in LCO 3.3.6.1 overlaps this SR to providecomplete testing of the safety function. The 24 monthFrequency was developed considering it is prudent that thisSurveillance be performed only during a unit outage sinceisolation of penetrations would eliminate cooling water flowand disrupt the normal operation of many criticalcomponents. Operating experience has shown that thesecomponents will usually pass this Surveillance whenperformed at the 24 month Frequency. Therefore, theFrequency was concluded to be acceptable from a reliabilitystandpoint.

SR 3.6.1.3.11

This SR requires a demonstration that a representativesample of reactor instrumentation line excess flow checkvalve (EFCVs) is OPERABLE by verifying that the valveactuates to the isolation position on a simulated instrumentline break signal. The representative sample consists of anapproximately equal number of EFCVs, such that each EFCV istested at least once every 10 years (Nominal). In addition,the EFCVs in the sample are representative of the variousplant configurations, models, sizes and operatingenvironments. This ensures that any potentially commonproblem with a specific type of application of DFCV isdetected at the earliest possible time. This SR providesassurance that the instrumentation line EFCVs will performso that predicted radiological consequences will not beexceeded during a postulated instrument line break event.The nominal 10 year interval is based on other performance-based testing programs, such as Inservice Testing (Snubbers)and Option B to 10 CFR 50, Appendix J. Furthermore, anyEFCV failures will be evaluated to determine if additionaltesting in that test interval is warranted to ensure overallreliability is maintained. Operating experience hasdemonstrated that these components are highly reliable andthat failures to isolate are very infrequent. Therefore,testing of a representative sample was concluded to beacceptable from a reliability standpoint. For some EFCVs,this Surveillance can be performed with the reactor atpower.

SR 3.6.1.3.12

The TIP shear isolation valves are actuated by explosivecharges. An in place functional test is not possible withthis design. The explosive squib is removed and tested toprovide assurance that the valves will actuate whenrequired. The replacement charge for the explosive squibshall be from the same manufactured batch as the one firedor from another batch that has been certified by having oneof the batch successfully fired. The Frequency of 24 monthson a STAGGERED TEST BASIS is considered adequate given theadministrative controls on replacement charges and thefrequent checks of circuit continuity (SR 3.6.1.3.6).

(continued)PBAPS UNIT 2 B 3. 6-28 Revision No. 35

PCIVsB 3.6.1.3

BASES


(continued)

SR 3.6.1.3.13

This SR ensures that in case the non-safety grade instrumentair system is unavailable, the SGIG System will perform itsdesign function to supply nitrogen gas at the requiredpressure for valve operators and valve seals supported bythe SGIG System. The 24 month Frequency was developedconsidering it is prudent that this Surveillance beperformed only during a plant outage. Operating experiencehas shown that these components will usually pass thisSurveillance when performed at the 24 month Frequency.Therefore, the Frequency was concluded to be acceptable froma reliability standpoint.

SR 3.6.1.3.14

Leakage through each MSIV must be • 11.5 scfh when tested att Pt (25 psig). The analyses in Reference I are based on

treatment of MSIV leakage as a secondary containment bypassleakage, independent of a primary to secondary containmentleakage analyzed at 1.27 L.. In the Reference I analysis all4 steam lines are assumed to leak at the TS Limit. Thisensures that MSIV leakage is properly accounted for indetermining the overall impacts of primary containmentleakage. The Frequency is required by the PrimaryContainment Leakage Rate Testing Program.

SR 3.6.1.3.15

Verifying the opening of each 6 inch and 18 inch primarycontainment purge valve and each 18 inch primary containmentexhaust valve is restricted by a blocking device to lessthan or equal to the required maximum opening anglespecified in the UFSAR (Ref. 4) is required to ensure thatthe valves can close under DBA conditions within the timesin the analysis of Reference 1. If a LOCA occurs, the purgeand exhaust valves must close to maintain primarycontainment leakage within the values assumed in theaccident analysis. At other times pressurization concernsare not present, thus the purge and exhaust valves can befully open. The 24 month Frequency is appropriate becausethe blocking devices may be removed during a refuelingoutage.

(continued)


PCIVsB 3.6.1.3

BASES


(continued) The inflatable seal of each 6 inch and 18 inch primarycontainment purge valve and each 18 inch primary containmentexhaust valve must be replaced every 96 months. This willallow the opportunity for replacement before gross leakagefailure occurs.

REFERENCES 1. UFSAR, Chapter 14.

2. UFSAR, Table 7.3.1.


4. UFSAR, Table 7.3.1, Note 17.

5. UFSAR, Table 5.2.2.

6. UFSAR, Table 7.3.1, Note 14.


Drywell Air TemperatureB 3.6.1.4


B 3.6.1.4 Drywell Air Temperature

BASES

BACKGROUND The drywell contains the reactor vessel and piping, whichadd heat to the airspace. Drywell coolers remove heat andmaintain a suitable environment. The average airspacetemperature affects the calculated response to postulatedDesign Basis Accidents (DBAs). The limitation on thedrywell average air temperature was developed as reasonable,based on operating experience. The limitation on drywellair temperature is used in the Reference I safety analyses.


Primary containment performance is evaluated for aspectrum of break sizes for postulated loss of coolantaccidents (LOCAs) (Ref. 1). Among the inputs to the designbasis analysis is the initial drywell average airtemperature (Ref. 1). Analyses assume an initial averagedrywell air temperature of 145°F. This limitation ensuresthat the safety analysis remains valid by maintaining theexpected initial conditions and ensures that the peak LOCAdrywell temperature does not exceed the maximum allowabletemperature of 281°F (Ref. 2) except for a brief period ofless than 20 seconds which was determined to be acceptablein References I and 3. Exceeding this design temperaturemay result in the degradation of the primary containmentstructure under accident loads. Equipment inside primarycontainment required to mitigate the effects of a DBA isdesigned to operate and be capable of operating underenvironmental conditions expected for the accident.

Drywell air temperature satisfies Criterion 2 of the NRCPolicy Statement.

LCO In the event of a DBA, with an initial drywell average airtemperature less than or equal to the LCO temperature limit,the resultant peak accident temperature is maintained withinacceptable limits for the drywell. As a result, the abilityof primary containment to perform its design function isensured.

(continued)



BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release ofradioactive material to primary containment. In MODES 4and 5, the probability and consequences of these events arereduced due to the pressure and temperature limitations ofthese MODES. Therefore, maintaining drywell average airtemperature within the limit is not required in MODE 4 or 5.

ACTIONS A.1

With drywell average air temperature not within the limit ofthe LCO, drywell average air temperature must be restoredwithin 8 hours. The Required Action is necessary to returnoperation to within the bounds of the primary containmentanalysis. The 8 hour Completion Time is acceptable,considering the sensitivity of the analysis to variations inthis parameter, and provides sufficient time to correctminor problems.

B.1 and B.2

If the drywell average air temperature cannot be restored towithin the limit within the required Completion Time, theplant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought toat least MODE 3 within 12 hours and to MODE 4 within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems.


Verifying that the drywell average air temperature is withinthe LCO limit ensures that operation remains within thelimits assumed for the primary containment analyses.Drywell air temperature is monitored in various quadrantsand at various elevations. Due to the shape of the drywell,a volumetric average is used to determine an accuraterepresentation of the actual average temperature.

(continued)



BASES


SR 3.6.1.4.1 (continued)

The 24 hour Frequency of the SR was developed based onoperating experience related to drywell average airtemperature variations and temperature dependent drift ofinstrumentation located in the drywell during the applicableMODES and the low probability of a DBA occurring betweensurveillances. Furthermore, the 24 hour Frequency isconsidered adequate in view of other indications availablein the control room, to alert the operator to an abnormaldrywell air temperature condition.

REFERENCES 1. Letter G94-PEPR-183, Peach Bottom Improved TechnicalSpecification Project Increased Drywell andSuppression Chamber Pressure Analytical Limits, fromG.V. Kumar (GE) to A.A. Winter (PECO), August 23,1994.




Reactor Building-to-Suppression Chamber Vacuum BreakersB 3.6.1.5


B 3.6.1.5 Reactor Building-to-Suppression Chamber Vacuum Breakers

BASES

BACKGROUND The function of the reactor building-to-suppression chambervacuum breakers is to relieve vacuum when primarycontainment depressurizes below reactor building pressure.If the drywell depressurizes below reactor buildingpressure, the negative differential pressure is mitigated byflow through the reactor building-to-suppression chambervacuum breakers and through the suppression-chamber-to-drywell vacuum breakers. The design of the external(reactor building-to-suppression chamber) vacuum reliefprovisions consists of two vacuum breakers (a check valveand an air operated butterfly valve), located in series ineach of two lines from the reactor building to thesuppression chamber airspace. The butterfly valve isactuated by a differential pressure signal. The check valveis self actuating and can be manually operated for testingpurposes. The two vacuum breakers in series must be closedto maintain a leak tight primary containment boundary.

A negative differential pressure across the drywell wall iscaused by rapid depressurization of the drywell. Eventsthat cause this rapid depressurization are cooling cycles,primary containment spray actuation, and steam condensationin the event of a primary system rupture. Reactorbuilding-to-suppression chamber vacuum breakers prevent anexcessive negative differential pressure across the primarycontainment boundary. Cooling cycles result in minorpressure transients in the drywell, which occur slowly andare normally controlled by heating and ventilationequipment. Inadvertent spray actuation results in asignificant negative pressure transient and is the designbasis event postulated in sizing the external (reactorbuilding-to-suppression chamber) vacuum breakers.

The external vacuum breakers are sized on the basis of theair flow from the secondary containment that is required tomitigate the depressurization transient and limit themaximum negative containment (suppression chamber) pressureto within design limits. The maximum depressurization rateis a function of the primary containment spray flow rate andtemperature and the assumed initial conditions of the

(continued)



BASES

BACKGROUND suppression chamber atmosphere. Low spray temperatures and(continued) atmospheric conditions that yield the minimum amount of

contained noncondensible gases are assumed for conservatism.

The Safety Grade Instrument Gas (SGIG) System suppliespressurized nitrogen gas (from the Containment AtmosphericDilution (CAD) System liquid nitrogen storage tank) as asafety grade pneumatic source to the CAC System purge andexhaust isolation valve inflatable seals, the reactorbuilding-to-suppression chamber vacuum breaker air operatedisolation butterfly valves and inflatable seal, and the CACand CAD Systems vent control air operated valves. The SGIGSystem thus performs two distinct post-LOCA functions: (1)supports containment isolation and (2) supports CAD Systemvent operation. SGIG System requirements are addressed foreach of the supported system and components in LCO 3.6.1.3,"Primary Containment Isolation Valves (PCIVs)," LCO 3.6.1.5,"Reactor Building-to-Suppression Chamber Vacuum Breakers,"and LCO 3.6.3.1, "Containment Atmospheric Dilution (CAD)System." For the SGIG System, liquid nitrogen from the CADSystem liquid nitrogen storage tank passes through the CADSystem liquid nitrogen vaporizer where it is converted to agas. The gas then flows into a Unit 2 header and a Unit 3header separated by two manual globe valves. From eachheader, the gas then branches to each valve operator orvalve seal supplied by the SGIG System. Each branch isseparated from the header by-a manual globe valve and acheck valve.

To support SGIG System functions, the CAD System liquidnitrogen storage tank minimum required level is a 16 incheswater column and a minimum required SGIG System headerpressure of 80 psig. Minimum requirements for the CADSystem liquid nitrogen storage tank to support CAD SystemOPERABILITY are specified in LCO 3.6.3.1, "ContainmentAtmospheric Dilution (CAD) System."

APPLICABLE Analytical methods and assumptions involving the reactorSAFETY ANALYSES building-to-suppression chamber vacuum breakers are used as

part of the accident response of the containment systems.Internal (suppression-chamber-to-drywell) and external(reactor building-to-suppression chamber) vacuum breakers

(continued)



BASES

APPLICABLE are provided as part of the primary containment to limit theSAFETY ANALYSES negative differential pressure across the drywell and

(continued) suppression chamber walls, which form part of the primarycontainment boundary.

The safety analyses assume the external vacuum breakers tobe closed initially and to be fully open at 0.75 psid.Additionally, of the four reactor building-to-suppressionchamber vacuum breakers (two in each of the two lines fromthe reactor building-to-suppression chamber airspace), oneis assumed to fail in a closed position to satisfy thesingle active failure criterion. Design Basis Accident(DBA) analyses require the vacuum breakers to be closedinitially and to remain closed and leak tight with positiveprimary containment pressure.

Three cases were considered in the safety analyses todetermine the adequacy of the external vacuum breakers:

a. A small break loss of coolant accident followed byactuation of both drywell spray loops;

b. Inadvertent actuation of one drywell spray loop duringnormal operation; and

c. A postulated DBA assuming low pressure coolantinjection flow out the loss of coolant accident break,which condenses the drywell steam.

The results of these three cases show that the externalvacuum breakers, with an opening setpoint of 0.75 psid, arecapable of maintaining the differential pressure withindesign limits.

The reactor building-to-suppression chamber vacuum breakerssatisfy Criterion 3 of the NRC Policy Statement.

LCO All reactor building-to-suppression chamber vacuum breakersare required to be OPERABLE to satisfy the assumptions usedin the safety analyses. The requirement ensures that thetwo vacuum breakers (check valve and air operated butterflyvalve) in each of the two lines from the reactor building to

(continued)



BASES

LCO(continued)

the suppression chamber airspace are closed. Also, therequirement ensures both vacuum breakers in each line willopen to relieve a negativepressure in the suppressionchamber (except during testing or when performing theirintended function).

In addition, for the reactor building-to-suppression chambervacuum breakers to be considered OPERABLE and closed, theSGIG System supplying nitrogen gas to the air operatedvalves and inflatable seal of the vacuum breakers must beOPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessivenegative differential pressure across the drywell wallcaused by the rapid depressurization of the drywell. Theevent that results in the limiting rapid depressurization ofthe drywell is the primary system rupture, which purges thedrywell of air and fills the drywell free airspace withsteam. Subsequent condensation of the steam would result indepressurization of the drywell. The limiting pressure andtemperature of the primary system prior to a DBA occur inMODES 1, 2, and 3. Excessive negative pressure insideprimary containment could also occur due to inadvertentinitiation of the Drywell Spray System.

In MODES 4 and 5, the probability and consequences of theseevents are reduced due to the pressure and temperaturelimitations in these MODES. Therefore, maintaining reactorbuilding-to-suppression chamber vacuum breakers OPERABLE isnot required in MODE 4 or 5.

ACTIONS A Note has been added to provide clarification that, for thepurpose of this LCO, separate Condition entry is allowed foreach penetration flow path.

A.1

With one or more lines with one vacuum breaker not closed,the leak tight primary containment boundary may bethreatened. Therefore, the inoperable vacuum breakers mustbe restored to OPERABLE status or the open vacuum breakerclosed within 72 hours. The 72 hour Completion Time isconsistent with requirements for inoperable suppressionchamber-to-drywell vacuum breakers in LCO 3.6.1.6,

(continued)



BASES


"Suppression Chamber-to-Drywell Vacuum Breakers." The72 hour Completion Time takes into account the redundantcapability afforded by the remaining breakers, the fact thatthe OPERABLE breaker in each of the lines is closed, and thelow probability of an event occurring that would require thevacuum breakers to be OPERABLE during this period.

B.1

With one or more lines with two vacuum breakers not closed,primary containment integrity is not maintained. Therefore,one open vacuum breaker must be closed within I hour. ThisCompletion Time is consistent with the ACTIONS ofLCO 3.6.1.1, "Primary Containment," which requires thatprimary containment be restored to OPERABLE status withinI hour.

C.1

With one line with one or more vacuum breakers inoperablefor opening, the leak tight primary containment boundary isintact. The ability to mitigate an event that causes acontainment depressurization is threatened if one or morevacuum breakers in at least one vacuum breaker penetrationare not OPERABLE. Therefore, the inoperable vacuum breakermust be restored to OPERABLE status within 72 hours. Thisis consistent with the Completion Time for Condition A andthe fact that the leak tight primary containment boundary isbeing maintained.

D.1

With two lines with one or more vacuum breakers inoperablefor opening, the primary containment boundary is intact.However, in the event of a containment depressurization, thefunction of the vacuum breakers is lost. Therefore, allvacuum breakers in one line must be restored to OPERABLEstatus within I hour. This Completion Time is consistentwith the ACTIONS of LCO 3.6.1.1, which requires that primarycontainment be restored to OPERABLE status within 1 hour.

(continued)



BASES

ACTIONS E.1 and E.2(continued)

If any Required Action and associated Completion Time cannotbe met, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 12 hours and to MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.


Verifying that the level in the CAD liquid nitrogen tank is: 16 inches water column will ensure at least 7 days ofpost-LOCA SGIG System operation. This minimum volume ofliquid nitrogen allows sufficient time after an accident toreplenish the nitrogen supply in order to maintain thedesign function of the reactor building-to-suppressionvacuum breakers. The level is verified every 24 hours toensure that the system is capable of performing its intendedisolation function when required. The 24 hour Frequency isbased on operating experience, which has shown to be anacceptable period to verify liquid nitrogen supply. The 24hour Frequency also signifies the importance of the SGIGSystem for maintaining the design function of the reactorbuilding-to-suppression chamber vacuum breakers.

SR 3.6.1.5.2

This SR ensures that the pressure in the SGIG System headeris ; 80 psig. This ensures that the post-LOCA nitrogenpressure provided to the valve operators and valve sealsthat is adequate for the SGIG to perform its designfunction. The 24 hour Frequency was developed consideringthe importance of the SGIG System for maintaining the designfunction of the reactor building-to-suppression chambervacuum breakers. The 24 hour Frequency is also consideredto be adequate to ensure timely detection of any breach inthe SGIG System which would render the system incapable ofperforming its function.

(continued)



BASES


(continued)

SR 3.6.1.5.3

Each vacuum breaker is verified to be closed to ensure thata potential breach in the primary containment boundary isnot present. This Surveillance is performed by observinglocal or control room indications of vacuum breaker positionor by verifying a differential pressure of 0.75 psid ismaintained between the reactor building and suppressionchamber. The 14 day Frequency is based on engineeringjudgment, is considered adequate in view of otherindications of vacuum breaker status available to operationspersonnel, and has been shown to be acceptable throughoperating experience.

Two Notes are added to this SR. The first Note allowsreactor building-to-suppression chamber vacuum breakersopened in conjunction with the performance of a Surveillanceto not be considered as failing this SR. These periods ofopening vacuum breakers are controlled by plant proceduresand do not represent inoperable vacuum breakers. A secondNote is included to clarify that vacuum breakers open due toan actual differential pressure, are not considered asfailing this SR.

SR 3.6.1.5.4

Verifying the correct alignment for each manual valve in theSGIG System required flow paths provides assurance that theproper flow paths exist for system operation. This SR doesnot apply to valves that are locked or otherwise secured inposition, since these valves were verified to be in thecorrect position prior to locking or securing. This SR doesnot require any testing or valve manipulation; rather, itinvolves verification that those valves capable of beingmispositioned are in the correct position. This SR does notapply to valves that cannot be inadvertently misaligned,such as check valves. The 31 day Frequency is based onengineering judgment, is consistent with the proceduralcontrols governing valve operation, and ensures correctvalve positions.

(continued)



BASES


(continued) Each vacuum breaker must be cycled to ensure that it opensproperly to perform its design function and returns to itsfully closed position. This ensures that the safetyanalysis assumptions are valid. The 92 day Frequency ofthis SR was developed based upon Inservice Testing Programrequirements to perform valve testing at least once every92 days.

SR 3.6.1.5.6

Demonstration of air operated vacuum*breaker openingsetpoint is necessary to ensure that the safety analysisassumption regarding vacuum breaker full open differentialpressure of r 0.75 psid is valid. The 18 month Frequency isbased on requirements associated with the instruments thatmonitor differential pressure between the reactor buildingand suppression chamber and that this Surveillance can beperformed while the plant is operating. For this unit, the18 month Frequency has been shown to be acceptable, based onoperating experience. Operating experience has shown thatthese components usually pass the surveillance whenperformed at an 18 month frequency, and is further justifiedbecause of other surveillances performed at shorterFrequencies that convey the proper functioning status ofeach vacuum breaker.

SR 3.6.1.5.7

This SR ensures that in case the non-safety grade instrumentair system is unavailable, the SGIG System will perform itsdesign function to supply nitrogen gas at the requiredpressure for valve operators and valve seals supported bythe SGIG System. The 24 month Frequency was developedconsidering it is prudent that this Surveillance beperformed only during a plant outage. Operating experiencehas shown that these components will usually pass thisSurveillance when performed at the 24 month Frequency.Therefore, the Frequency was concluded to be acceptable froma reliability standpoint.

REFERENCES None


Suppression Chamber-to-Drywell Vacuum BreakersB 3.6.1.6


B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers

BASES

BACKGROUND The function of the suppression chamber-to-drywell vacuumbreakers is to relieve vacuum in the drywell. There are12 internal vacuum breakers located on the vent header ofthe vent system between the drywell and the suppressionchamber, which allow air and steam flow from the suppressionchamber to the drywell when the drywell is at a negativepressure with respect to the suppression chamber.Therefore, suppression chamber-to-drywell vacuum breakersprevent an excessive negative differential pressure acrossthe wetwell drywell boundary. Each vacuum breaker is a selfactuating valve, similar to a check valve, which can beremotely operated for testing purposes.

A negative differential pressure across the drywell wall iscaused by rapid depressurization of the drywell. Eventsthat cause this rapid depressurization are cooling cycles,drywell spray actuation, and steam condensation from spraysor subcooled water reflood of a break in the event of aprimary system rupture. Cooling cycles result in minorpressure transients in the drywell that occur slowly and arenormally controlled by heating and ventilation equipment.Spray actuation or spill of subcooled water out of a breakresults in more significant pressure transients and becomesimportant in sizing the internal vacuum breakers.

In the event of a primary system rupture, steam condensationwithin the drywell results in the most severe pressuretransient. Following a primary system rupture, air in thedrywell is purged into the suppression chamber freeairspace, leaving the drywell full of steam. Subsequentcondensation of the steam can be caused in two possibleways, namely, Emergency Core Cooling Systems flow from arecirculation line break, or drywell spray actuationfollowing a loss of coolant accident (LOCA). These twocases determine the maximum depressurization rate of thedrywell.

In addition, the waterleg in the Mark I Vent Systemdowncomer is controlled by the drywell-to-suppressionchamber differential pressure. If the drywell pressure isless than the suppression chamber pressure, there will be anincrease in the vent waterleg. This will result in an

(continued)

S



BASES


increase in the water clearing inertia in the event of apostulated LOCA, resulting in an increase in the peakdrywell pressure. This in turn will result in an increasein the pool swell dynamic loads. The internal vacuumbreakers limit the height of the waterleg in the vent systemduring normal operation.


Analytical methods and assumptions involving thesuppression chamber-to-drywell vacuum breakers are used aspart of the accident response of the primary containmentsystems. Internal (suppression chamber-to-drywell) andexternal (reactor building- to-suppression chamber) vacuumbreakers are provided as part of the primary containment tolimit the negative differential pressure across the drywelland suppression chamber walls that form part of the primarycontainment boundary.

The safety analyses assume that the internal vacuum breakersare closed initially and are fully open at a differentialpressure of 0.5 psid. Additionally, 1 of the 9 internalvacuum breakers required to open is assumed to fail in aclosed position. The results of the analyses show that thedesign pressure is not exceeded even under the worst caseaccident scenario. The vacuum breaker opening differentialpressure setpoint and the requirement that 9 of 12 vacuumbreakers be OPERABLE are a result of the requirement placedon the vacuum breakers to limit the vent system waterlegheight. The total cross sectional area of the main ventsystem between the drywell and suppression chamber needed tofulfill this requirement has been established as a minimumof 51.5 times the total break area. In turn, the vacuumrelief capacity between the drywell and suppression chambershould be 1/16 of the total main vent cross sectional area,with the valves set to operate at 0.5 psid differentialpressure. This was the original design basis for PeachBottom, which required 10 18" vacuum breakers to meet the1/16 of the total main vent cross sectional area. However,the current design basis requirement for 9 vacuum breakersrequired to be operable, one of which is assumed to fail toopen (single active failure), is found in Reference 2.Design Basis Accident (DBA) analyses require the vacuumbreakers to be closed initially and to remain closed andleak tight, until the suppression pool is at a positivepressure relative to the drywell. All suppression chamber-to-drywell vacuum breakers are considered closed if a leaktest confirms that the bypass area between the drywell andsuppression chamber is less than or equivalent to a one-inchdiameter hole (Ref. 1).

The suppression chamber-to-drywell vacuum breakers satisfyCriterion 3 of the NRC Policy Statement.

(continued)



BASES (continued)

LCO Only 9 of the 12 vacuum breakers must be OPERABLE foropening. All suppression chamber-to-drywell vacuum breakersare required to be closed (except when the vacuum breakersare performing their intended design function). Allsuppression chamber-to-drywell vacuum breakers areconsidered closed, even if position indication shows thatone or more vacuum breakers is not fully seated, if a leaktest confirms that the bypass area between the drywell andsuppression chamber is less than or equivalent to a one-inchdiameter hole. The vacuum breaker OPERABILITY requirementprovides assurance that the drywell-to-suppression chambernegative differential pressure remains below the designvalue. The requirement that the vacuum breakers be closedensures that there is no excessive bypass leakage should aLOCA occur.

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessivenegative differential pressure across the drywell wall,caused by the rapid depressurization of the drywell. Theevent that results in the limiting rapid depressurization ofthe drywell is the primary system rupture that purges thedrywell of air and fills the drywell free airspace withsteam. Subsequent condensation of the steam would result indepressurization of the drywell. The limiting pressure andtemperature of the primary system prior to a DBA occur inMODES 1, 2, and 3. Excessive negative pressure inside thedrywell could also occur due to inadvertent actuation of theDrywell Spray System.

In MODES 4 and 5, the probability and consequences of theseevents are reduced by the pressure and temperaturelimitations in these MODES; therefore, maintainingsuppression chamber-to-drywell vacuum breakers OPERABLE isnot required in MODE 4 or 5.

ACTIONS A.__

With one of the required vacuum breakers inoperable foropening (e.g., the vacuum breaker is not open and may bestuck closed or not within its opening setpoint limit, sothat it would not function as designed during an event thatdepressurized the drywell), the remaining eight OPERABLEvacuum breakers are capable of providing the vacuum relieffunction. However, overall system reliability is reduced

(continued)



BASES


because a single failure in one of the remaining vacuumbreakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA. Therefore,with one of the nine required vacuum breakers inoperable,72 hours is allowed to restore the inoperable vacuum breakerto OPERABLE status so that plant conditions are consistentwith those assumed for the design basis analysis. The72 hour Completion Time is considered acceptable due to thelow probability of an event in which the remaining vacuumbreaker capability would not be adequate.

B.1

An open vacuum breaker allows communication between thedrywell and suppression chamber airspace, and, as a result,there is the potential for suppression chamberoverpressurization due to this bypass leakage if a LOCA wereto occur. Therefore, the open vacuum breaker must beclosed. A short time is allowed to close the vacuum breakerdue to the low probability of an event that would pressurizeprimary containment. If vacuum breaker position indicationis not reliable, an alternate method of verifying that thevacuum breakers are closed must be performed within10 hours. All suppression chamber-to-drywell vacuumbreakers are considered closed, even if the "not fullyseated" indication is shown, if a leak test confirms thatthe bypass area between the drywell and suppression chamberis less than or equivalent to a one-inch diameter hole(Ref. 1). The required 10 hour Completion Time isconsidered adequate to perform this test. If the leak testfails, not only must the Actions be taken (close the openvacuum breaker within 10 hours), but also the appropriateCondition and Required Actions of LCO 3.6.1.1, PrimaryContainment, must be entered.

C.1 and C.2

If the inoperable suppression chamber-to-drywell vacuumbreaker cannot be closed or restored to OPERABLE statuswithin the required Completion Time, the plant must bebrought to a MODE in which the LCO does not apply. Toachieve this status, the plant must be brought to at least

(continuedl



BASES


MODE 3 within 12 hours and to MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.


Each vacuum breaker is verified closed to ensure that thispotential large bypass leakage path is not present. ThisSurveillance is performed by observing the vacuum breakerposition indication or by performing a leak test thatconfirms that the bypass area between the drywell andsuppression chamber is less than or equivalent to a one-inchdiameter hole. If the bypass test fails, not only must thevacuum breaker(s) be considered open and the appropriateConditions and Required Actions of this LCO be entered, butalso the appropriate Condition and Required Action of LCO3.6.1.1 must be entered. The 14 day Frequency is based onengineering judgment, is considered adequate in view ofother indications of vacuum breaker status available tooperations personnel, and has been shown to be acceptablethrough operating experience.

A Note is added to this SR which allows suppression chamber-to-drywell vacuum breakers opened in conjunction with theperformance of a Surveillance to not be considered asfailing this SR. These periods of opening vacuum breakersare controlled by plant procedures and do not representinoperable vacuum breakers.

SR 3.6.1.6.2

Each required vacuum breaker must be cycled to ensure thatit opens adequately to perform its design function andreturns to the fully closed position. This ensures that thesafety analysis assumptions are valid. The 31 day Frequencyof this SR was developed, based on Inservice Testing Programrequirements to perform valve testing at least once every92 days. A 31 day Frequency was chosen to provideadditional assurance that the vacuum breakers are OPERABLE,since they are located in a harsh environment (thesuppression chamber airspace).

(continued)



BASES


(continued)

SR 3.6.1.6.3

Verification of the vacuum breaker setpoint for full openingis necessary to ensure that the safety analysis assumptionregarding vacuum breaker full open differential pressure of0.5 psid is valid. The 24 month Frequency is based on theneed to perform this Surveillance under the conditions thatapply during a plant outage and the potential for anunplanned transient if the Surveillance were performed withthe reactor at power. For this facility, the 24 monthFrequency has been shown to be acceptable, based onoperating experience, and is further justified because ofother surveillances performed at shorter Frequencies thatconvey the proper functioning status of each vacuum breaker.

REFERENCES 1. Safety Evaluation by the Office of Nuclear ReactorRegulation Supporting Amendment Nos. 127 and 130 toFacility Operating License Nos. DPR-44 and DPR-56,dated February 18, 1988.

2. ME-0161, "Det. Actual # Wetwell to Drywell VacuumBreakers Reqd"


Suppression Pool Average TemperatureB 3.6.2.1


B 3.6.2.1 Suppression Pool Average Temperature

BASES

BACKGROUND The suppression chamber is a toroidal shaped, steel pressurevessel containing a volume of water called the suppressionpool. The suppression pool is designed to absorb the decayheat and sensible energy released during a reactor blowdownfrom safety/relief valve discharges or from Design BasisAccidents (DBAs). The suppression pool must quench all thesteam released through the downcomer lines during a loss ofcoolant accident (LOCA). This is the essential mitigativefeature of a pressure suppression containment that ensuresthat the peak containment pressure is maintained below themaximum allowable pressure for DBAs (56 psig). Thesuppression pool must also condense steam from steam exhaustlines in the turbine driven systems (i.e., the High PressureCoolant Injection System and Reactor Core Isolation CoolingSystem), Suppression pool average temperature (along withLCO 3.6.2.2, "Suppression Pool Water Level") is a keyindication of the capacity of the suppression pool tofulfill these requirements.

The technical concerns that lead to the development ofsuppression pool average temperature limits are as follows:

a. Complete steam condensation-the original limit for theend of a LOCA blowdown was 170°F, based on the BodegaBay and Humboldt Bay Tests;

b. Primary containment peak pressure and temperature-design pressure is 56 psig and design temperature is281°F (Ref. 1);

c. Condensation oscillation loads-maximum allowableinitial temperature is 110°F.

APPLICABLE The postulated DBA against which the primary containmentSAFETY ANALYSES performance is evaluated is the entire spectrum of

postulated pipe breaks within the primary containment.Inputs to the safety analyses include initial suppressionpool water volume and suppression pool temperature (Ref. 2).An initial pool temperature of 95'F is assumed for the

(continued)



BASES

APPLICABLE Reference I and Reference 2 analyses. Reactor shutdown at aSAFETY ANALYSES pool temperature of 110°F and vessel depressurization at a

(continued) pool temperature of 120°F are assumed for the Reference 2analyses. The limit of 1050 F, at which testing isterminated, is not used in the safety analyses because DBAsare assumed to not initiate during unit testing.

Suppression pool average temperature satisfies Criteria 2and 3 of the NRC Policy Statement.

LCO A limitation on the suppression pool average temperature isrequired to provide assurance that the containmentconditions assumed for the safety analyses are met. Thislimitation subsequently ensures that peak primarycontainment pressures and temperatures do not exceed maximumallowable values during a postulated DBA or any transientresulting in heatup of the suppression pool. The LCOrequirements are:

a. Average temperature - 950 F when any OPERABLE widerange neutron monitor (WRNM) channel is at 1.OOEO %power or above and no testing that adds heat to thesuppression pool is being performed. This requirementensures that licensing bases initial conditions aremet.

b. Average temperature g 1050F when any OPERABLE WRNMchannel is at 1.OOEO % power or above and testing thatadds heat to the suppression pool is being performed.This required value ensures that the unit has testingflexibility, and was selected to provide margin belowthe 110°F limit at which reactor shutdown is required.When testing ends, temperature must be restored to• 95°F within 24 hours according to RequiredAction A.2. Therefore, the time period that thetemperature is > 95 0 F is short enough not to cause asignificant increase in unit risk.

c. Average temperature , H1OOF when all OPERABLE WRNMchannels are below I.OOEO % power. This requirementensures that the unit will be shut down at > 110 0 F.The pool is designed to absorb decay heat and sensibleheat but could be heated beyond design limits by thesteam generated if the reactor is not shut down.

(continued)



BASES

I LCO(continued)

Note that WRNM indication at I.OOEO % power is aconvenient measure of when the reactor is producing poweressentially equivalent to 1% RTP. At this power level, heatinput is approximately equal to normal system heat losses.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant heatupof the suppression pool. In MODES 4 and 5, the probabilityand consequences of these events are reduced due to thepressure and temperature limitations in these MODES.Therefore, maintaining suppression pool average temperaturewithin limits is not required in MODE 4 or 5.

ACTIONS A.I and A.2

With the suppression pool average temperature above thespecified limit when not performing testing that adds heatto the suppression pool and when above the specified powerindication, the initial conditions exceed the conditionsassumed for the Reference 1, 2, and 3 analyses. However,primary containment cooling capability still exists, and theprimary containment pressure suppression function will occurat temperatures well above those assumed for safetyanalyses. Therefore, continued operation is allowed for alimited time. The 24 hour Completion Time is adequate toallow the suppression pool average temperature to berestored below the limit. Additionally, when suppressionpool temperature is > 950 F, increased monitoring of thesuppression pool temperature is required to ensure that itremains < 110°F. The once~per hour Completion Time isadequate based on past experience, which has shown that pooltemperature increases relatively slowly except when testingthat adds heat to the suppression pool is being performed.Furthermore, the once per hour Completion Time is consideredadequate in view of other indications in the control room,including alarms, to alert the operator to an abnormalsuppression pool average temperature condition.

B.1

If the suppression pool average temperature cannot berestored to within limits within the required CompletionTime, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the power must bereduced to below 1.OOEO % power for all OPERABLE WRNMs

(continued) 0



BASES


within 12 hours. The 12 hour Completion Time is reasonable,based on operating experience, to reduce power from fullpower conditions in an orderly manner and withoutchallenging plant systems.

C.1

Suppression pool average temperature is allowed to be > 95°Fwhen any OPERABLE WRNM channel is at I-OOEO % power orabove, and when testing that adds heat to the suppressionpool is being performed. However, if temperature is> 105°F, all testing must be immediately suspended topreserve the heat absorption capability of the suppressionpool. With the testing suspended, Condition A is enteredand the Required Actions and associated Completion Times areapplicable.

D.1, D.2. and D.3

Suppression pool average temperature > 110°F requires thatthe reactor be shut down immediately. This is accomplishedby placing the reactor mode switch in the shutdown position.Further cooldown to MODE 4 is required at normal cooldownrates (provided pool temperature remains • 120°F).Additionally, when suppression pool temperature is > 110 0 F,increased monitoring of pool temperature is required toensure that it remains • 120°F. The once per 30 minuteCompletion Time is adequate, based on operating experience.Given the high suppression pool average temperature in thisCondition, the monitoring Frequency is increased to twicethat of Condition A. Furthermore, the 30 minute CompletionTime is considered adequate in view of other indicationsavailable in the control room, including alarms, to alertthe operator to an abnormal suppression pool averagetemperature condition.

E.1 and E.2

If suppression pool average temperature cannot be maintainedat • 120°F, the plant must be brought to a MODE in which theLCO does not apply. To achieve this status, the reactorpressure must be reduced to < 200 psig within 12 hours, andthe plant must be brought to at least MODE 4 within

(continued)



BASES


36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems.

Continued addition of heat to the suppression pool withsuppression pool temperature > 120"F could result inexceeding the design basis maximum allowable values forprimary containment temperature or pressure. Furthermore,if a blowdown were to occur when the temperature was> 120"F, the maximum allowable bulk and local temperaturescould be exceeded very quickly.


The suppression pool average temperature is regularlymonitored to ensure that the required limits are satisfied.The average temperature is determined by taking anarithmetic average of OPERABLE suppression pool watertemperature channels. The 24 hour Frequency has been shown,based on operating experience, to be acceptable. When heatis being added to the suppression pool by testing, however,it is necessary to monitor suppression pool temperature morefrequently. The 5 minute Frequency during testing isjustified by the rates at which tests will heat up thesuppression pool, has been shown to be acceptable based onoperating experience, and provides assurance that allowablepool temperatures are not exceeded. The Frequencies arefurther justified in view-of other indications available inthe control room, including alarms, to alert the operator toan abnormal suppression pool average temperature condition.



3. NUREG-0783.


Suppression Pool Water LevelB 3.6.2.2


B 3.6.2.2 Suppression Pool Water Level

BASES

BACKGROUND The suppression chamber is a toroidal shaped, steel pressurevessel containing a volume of water called the suppressionpool. The suppression pool is designed to absorb the energyassociated with decay heat and sensible heat released duringa reactor blowdown from safety/relief valve (S/RV)discharges or from a Design Basis Accident (DBA). Thesuppression pool must quench all the steam released throughthe downcomer lines during a loss of coolant accident(LOCA). This is the essential mitigative feature of apressure suppression containment, which ensures that thepeak containment pressure is maintained below the maximumallowable pressure for DBAs (56 psig). The suppression poolmust also condense steam from the steam exhaust lines in theturbine driven systems (i.e., High Pressure CoolantInjection (HPCI) System and Reactor Core Isolation Cooling(RCIC) System) and provides the main emergency water supplysource for the reactor vessel. The suppression pool volumeranges between 122,900 ft 3 at the low water level limit of14.5 feet and 127,300 ft 3 at the high water level limit of14.9 feet.

If the suppression pool water level is too low, aninsufficient amount of water would be available toadequately condense the steam from the S/RV quenchers, mainvents, or HPCI and RCIC turbine exhaust lines. Lowsuppression pool water level could also result in aninadequate emergency makeup water source to the EmergencyCore Cooling System. The lower volume would also absorbless steam energy before heating up excessively. Therefore,a minimum suppression pool water level is specified.

If the suppression pool water level is too high, it couldresult in excessive clearing loads from S/RV discharges andexcessive pool swell loads during a DBA LOCA. Therefore, amaximum pool water level is specified. This LCO specifiesan acceptable range to prevent the suppression pool waterlevel from being either too high or too low.

(continued)



BASES (continued)

APPLICABLE Initial suppression pool water level affects suppressionSAFETY ANALYSES pool temperature response calculations, calculated drywell

pressure during vent clearing for a DBA, calculated poolswell loads for a DBA LOCA, and calculated loads due to S/RVdischarges. Suppression pool water level must be maintainedwithin the limits specified so that the safety analysis ofReference 1 remains valid.

Suppression pool water level satisfies Criteria 2 and 3 ofthe NRC Policy Statement.

LCO A limit that suppression pool water level be 2 14.5 feet ands 14.9 feet is required to ensure that the primarycontainment conditions assumed for the safety analyses aremet. Either the high or low water level limits were used inthe safety analyses, depending upon which is moreconservative for a particular calculation.

APPLICABILITY In MODES 1, 2, and 3, a DBA would cause significant loads on.the primary containment. In MODES 4 and 5, the probabilityand consequences of these events are reduced due to thepressure and temperature limitations in these MODES. Therequirement for maintaining suppression pool water levelwithin limits in MODE 4 or 5 is addressed in LCO 3.5.2,"ECCS-Shutdown'.

ACTIONS A.1

With suppression pool water level outside the limits, theconditions assumed for the safety analyses are not met. Ifwater level is below the minimum level, the pressuresuppression function still exists as long as main vents arecovered, HPCI and RCIC turbine exhausts are covered, andS/RV quenchers are covered. If suppression pool water levelis above the maximum level, protection againstoverpressurization still exists due to the margin in thepeak containment pressure analysis and the capability of theDrywell Spray System. Therefore, continued operation for alimited time is allowed. The 2 hour Completion Time issufficient to restore suppression pool water level to withinlimits. Also, it takes into account the low probability ofan event impacting the suppression pool water leveloccurring during this interval.

(continued)



BASES

ACTIONS B.] and B.2(continued)

If suppression pool water level cannot be restored to withinlimits within the required Completion Time, the plant mustbe brought to a MODE in which the LCO does not apply. Toachieve this status, the plant must be brought to at leastMODE 3 within 12 hours and to MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.


Verification of the suppression pool water level is toensure that the required limits are satisfied. The 24 hourFrequency of this SR was developed considering operatingexperience related to trending variations in suppressionpool water level and water level instrument drift during theapplicable MODES and to assessing the proximity to thespecified LCO level limits. Furthermore, the 24 hourFrequency is considered adequate in view of otherindications available in the control room, including alarms,to alert the operator to an abnormal suppression pool waterlevel condition.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.


RHR Suppression Pool CoolingB 3.6.2.3


B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling

BASES

BACKGROUND Following a Design Basis Accident (DBA), the RHR SuppressionPool Cooling System removes heat from the suppression pool.The suppression pool is designed to absorb the sudden inputof heat from the primary system. In the long term, the poolcontinues to absorb residual heat generated by fuel in thereactor core. Some means must be provided to remove heatfrom the suppression pool so that the temperature inside theprimary containment remains within design limits. Thisfunction is provided by two redundant RHR suppression poolcooling subsystems. The purpose of this LCO is to ensurethat both subsystems are OPERABLE in applicable MODES.

The RHR System has two loops with each loop consisting oftwo motor driven pumps, two heat exchangers, and associatedpiping and valves. There are two RHR suppression poolcooling subsystems per RHR System loop. The four RHRsuppression pool cooling subsystems are manually initiatedand independently controlled. The four RHR suppression poolcooling subsystems perform the suppression pool coolingfunction by circulating water from the suppression poolthrough the RHR heat exchangers and returning it to thesuppression pool via the full flow test lines. Each fullflow test line is common to the two RHR suppression poolcooling subsystems in an RHR System loop. The High PressureService Water (HPSW) System circulating through the tubeside of the heat exchangers, exchanges heat with thesuppression pool water and discharges this heat to theexternal heat sink.

The heat removal capability of one RHR pump and one heatexchanger in one subsystem is sufficient to meet the overallDBA pool cooling requirement for loss of coolant accidents(LOCAs) and transient events such as a turbine trip or stuckopen safety/relief valve (S/RV). As a result, any one ofthe four RHR suppression pool cooling subsystems can providethe required suppression pool cooling function. S/RVleakage and High Pressure Coolant Injection System andReactor Core Isolation Cooling System testing increasesuppression pool temperature more slowly. The RHRSuppression Pool Cooling System is also used to lower thesuppression pool water bulk temperature following suchevents.

(continued)



BASES (continued)


Reference 1 contains the results of analyses used to predictprimary containment pressure and temperature following largeand small break LOCAs. The intent of the analyses is todemonstrate that the heat removal capacity of the RHRSuppression Pool Cooling System is adequate to maintain theprimary containment conditions within design limits. Thesuppression pool temperature is calculated to remain belowthe design limit.

The RHR Suppression Pool Cooling System satisfiesCriterion 3 of the NRC Policy Statement.

LCO During a DBA, a minimum of one RHR suppression pool coolingsubsystem is required to maintain the primary containmentpeak pressure and temperature below design limits (Ref. 1).To ensure that these requirements are met, two RHRsuppression pool cooling subsystems (one in each loop) mustbe OPERABLE with power from two safety related independentpower supplies. (The two subsystems must be in separateloops since the full flow test line valves are common toboth subsystems in a loop.) Therefore, in the event of anaccident, at least one subsystem is OPERABLE assuming theworst case single active failure. An RHR suppression poolcooling subsystem is OPERABLE when one of the pumps, theassociated heat exchanger, a HPSW System pump capable ofproviding cooling to the heat exchanger and associatedpiping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release ofradioactive material to primary containment and cause aheatup and pressurization of primary containment. InMODES 4 and 5, the probability and consequences of theseevents are reduced due to the pressure and temperaturelimitations in these MODES. Therefore, the RHR SuppressionPool Cooling System is not required to be OPERABLE in MODE 4or 5.

ACTIONS A.1

With one RHR suppression pool cooling subsystem inoperable,the inoperable subsystem must be restored to OPERABLE statuswithin 7 days. In this Condition, the remaining RHRsuppression pool cooling subsystem is adequate to performthe primary containment cooling function. However, the

(continued)



BASES

ACTIONS A.I (continued)

overall reliability is reduced because a single failure inthe OPERABLE subsystem could result in reduced primarycontainment cooling capability. The 7 day Completion Timeis acceptable in light of the redundant RHR suppression poolcooling capabilities afforded by the OPERABLE subsystem andthe low probability of a DBA occurring during this period.

B.1

With two RHR suppression pool cooling subsystems inoperable,one subsystem must be restored to OPERABLE status within 8hours. In this condition, there is a substantial loss ofthe primary containment pressure and temperature mitigationfunction. The 8 hour Completion Time is based on this lossof function and is considered acceptable due to the lowprobability of a DBA and because alternative methods toremove heat from primary containment are available.

C.1 and C.2

If any Required Action and associated Completion Timecannot be met within the required Completion Time, the plantmust be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to atleast MODE 3 within 12 hours and to MODE 4 within 36 hours.The allowed Completion Times are reasonable, based onoperating experience, to reach the required plant conditionsfrom full power conditions in an orderly manner and withoutchallenging plant systems.


Verifying the correct alignment for manual, power operated,and automatic valves in the RHR suppression pool coolingmode flow path provides assurance that the proper flow pathexists for system operation. This SR does not apply tovalves that are locked, sealed, or otherwise secured inposition since these valves were verified to be in thecorrect position prior to locking, sealing, or securing. Avalve is also allowed to be in the nonaccident positionprovided it can be aligned to the accident position within

(continued)



BASES


the time assumed in the accident analysis. This isacceptable since the RHR suppression pool cooling mode ismanually initiated. This SR does not require any testing orvalve manipulation; rather, it involves verification thatthose valves capable of being mispositioned are in thecorrect position. This SR does not apply to valves thatcannot be inadvertently misaligned, such as check valves.

The Frequency of 31 days is justified because the valves areoperated under procedural control, improper valve positionwould affect only a single subsystem, the probability of anevent requiring initiation of the system is low, and thesubsystem is a manually initiated system. This Frequencyhas been shown to be acceptable based on operatingexperience.

SR 3.6.2.3.2

Verifying that each required RHR pump develops a flow rateZ!10,000 gpm while operating in the suppression pool coolingmode with flow through the associated heat exchanger ensuresthat pump performance has not degraded during the cycle.Flow is a normal test of centrifugal pump performancerequired by ASME Code, Section XI (Ref. 2). This testconfirms one point on the pump design curve, and the resultsare indicative of overall performance. Such inserviceinspections confirm component OPERABILITY, trendperformance, and detect incipient failures by indicatingabnormal performance. The Frequency of this SR is inaccordance with the Inservice Testing Program.


2. ASME, Boiler and Pressure Vessel Code, Section XI.


RHR Suppression Pool SprayB 3.6.2.4


B 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray

BASES

BACKGROUND Following a Design Basis Accident (DBA), the RHR SuppressionPool Spray System-removes heat from the suppression chamberairspace. The suppression pool is designed to absorb thesudden input of heat from the primary system from a DBA or arapid depressurization of the reactor pressure vessel (RPV)through safety/relief valves. The heat addition to thesuppression pool results in increased steam in thesuppression chamber, which increases primary containmentpressure. Steam blowdown from a DBA can also bypass thesuppression pool and end up in the suppression chamberairspace. Some means must be provided to remove heat fromthe suppression chamber so that the pressure and temperatureinside primary containment remain within analyzed designlimits. This function is provided by two redundant RHRsuppression pool spray subsystems. The purpose of this LCOis to ensure that both subsystems are OPERABLE in applicableMODES.

The RHR System has two loops with each loop consisting oftwo motor driven pumps, two heat exchangers, and associatedpiping and valves. There are two RHR suppression pool spraysubsystems per RHR System loop. The four RHR suppressionpool spray subsystems are manually, initiated andindependently controlled. The four RHR suppression poolspray subsystems perform the suppression pool spray functionby circulating water from the suppression pool through theRHR heat exchangers and returning it to the suppression poolspray spargers. Each suppression pool spray sparger line iscommon to the two RHR suppression pool spray subsystems inan RHR System loop. The spargers only accommodate a smallportion of the total RHR pump flow; the remainder of theflow returns to the suppression pool through the suppressionpool cooling return line. Thus, both suppression poolcooling and suppression pool spray functions are performedwhen the Suppression Pool Spray System is initiated. HighPressure Service Water, circulating through the tube side ofthe heat exchangers, exchanges heat with the suppressionpool water and discharges this heat to the external heat

(continued)



BASES


sink. Any one of the four RHR suppression pool spraysubsystems is sufficient to condense the steam from smallbypass leaks from the drywell to the suppression chamberairspace during the postulated DBA.


Reference I contains the results of analyses used to predictprimary containment pressure and temperature following largeand small break loss of coolant accidents. The intent ofthe analyses is to demonstrate that the pressure reductioncapacity of the RHR Suppression Pool Spray System isadequate to maintain the primary containment conditionswithin design limits. The time history for primarycontainment pressure is calculated to demonstrate that themaximum pressure remains below the design limit.

The RHR Suppression Pool Spray System satisfies Criterion 3of the NRC Policy Statement.

LCO In the event of a DBA, a minimum of one RHR suppression poolspray subsystem is required to mitigate potential bypassleakage paths and maintain the primary containment peakpressure below the design limits (Ref. 1). To ensure thatthese requirements are met, two RHR suppression pool spraysubsystems (one in each loop) must be OPERABLE with powerfrom two safety related independent power supplies. (Thetwo subsystems must be in separate loops since thesuppression pool spray sparger line valves are common toboth subsystems in a loop.) Therefore, in the event of anaccident, at least one subsystem is OPERABLE assuming theworst case single active failure. An RHR suppression poolspray subsystem is OPERABLE when one of the pumps, theassociated heat exchanger, a HPSW System pump capable ofproviding cooling to the heat exchanger and associatedpiping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization ofprimary containment. In MODES 4 and 5, the probability andconsequences of these events are reduced due to the pressureand temperature limitations in these MODES. Therefore,maintaining RHR suppression pool spray subsystems OPERABLEis not required in MODE 4 or 5.

(continued)



BASES (continued)

ACTIONS A.1

With one RHR suppression pool spray subsystem inoperable,the inoperable subsystem must be restored to OPERABLE statuswithin 7 days. In this Condition, the remaining OPERABLERHR suppression pool spray subsystem is adequate to performthe primary containment bypass leakage mitigation function.However, the overall reliability is reduced because a singlefailure in the OPERABLE subsystem could result in reducedprimary containment bypass mitigation capability. The 7 dayCompletion Time was chosen in light of the redundant RHRsuppression pool spray capabilities afforded by the OPERABLEsubsystem and the low probability of a DBA occurring duringthis period.

B.1

With both RHR suppression pool spray subsystems inoperable,at least one subsystem must be restored to OPERABLE statuswithin 8 hours. In this Condition, there is a substantialloss of the primary containment bypass leakage mitigationfunction. The 8 hour Completion Time is based on this lossof function and is considered acceptable due to the lowprobability of a DBA and because alternative methods toremove heat from primary containment are available.

C.1 and C.2

If the inoperable RHR suppression pool spray subsystemcannot be restored to OPERABLE status within the associatedCompletion Time, the plant must be brought to a MODE inwhich the LCO does not apply. To achieve this status, theplant must be brought to at least MODE 3 within 12 hours andMODE 4 within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.


Verifying the correct alignment for manual, power operated,and automatic valves in the RHR suppression pool spray modeflow path provides assurance that the proper flow paths will

(continued)



BASES


exist for system operation. This SR does not apply tovalves that are locked, sealed, or otherwise secured inposition since these valves were verified to be in thecorrect position prior to locking, sealing, or securing. Avalve is also allowed to be in the nonaccident positionprovided it can be aligned to the accident position withinthe time assumed in the accident analysis. This isacceptable since the RHR suppression pool cooling mode ismanually initiated. This SR does not require any testing orvalve manipulation; rather, it involves verification thatthose valves capable of being mispositioned are in thecorrect position. This SR does not apply to valves thatcannot be inadvertently misaligned, such as check valves.

The Frequency of 31 days is justified because the valves areoperated under procedural control, improper valve positionwould affect only a single subsystem, the probability of anevent requiring initiation of the system is low, and thesubsystem is a manually initiated system. This Frequencyhas been shown to be acceptable based on operatingexperience.

SR 3.6.2.4.2

This Surveillance is performed every 10 years to verify thatthe spray nozzles are not obstructed and that flow will beprovided when required. The 10 year Frequency is adequateto detect degradation in performance due to the passivenozzle design and its normally dry state and has been shownto be acceptable through operating experience.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.


CAD SystemB 3.6.3.1


B 3.6.3.1 Containment Atmospheric Dilution (CAD) System

BASES

BACKGROUND The CAD System functions to maintain combustible gasconcentrations within the primary containment at or belowthe flammability limits following a postulated loss ofcoolant accident (LOCA) by purging hydrogen and oxygen withnitrogen. To ensure that a combustible gas mixture does notoccur, oxygen concentration is kept < 5.0 volume percent(v/o).

The CAD System is manually initiated and consists of two100% capacity subsystems. Each subsystem consists of theliquid nitrogen supply tank, the atmospheric vaporizer, anelectric vaporizer, and connected piping to supply thedrywell and suppression chamber volumes. The liquidnitrogen tank, the atmospheric vaporizer and electricvaporizer are common components which are shared between theCAD subsystems of the two units. Piping from the liquidnitrogen tank downstream of the vaporizers is routed into acommon header where it is split and routed to each unit.Two pipes are routed to each unit. Each of the two pipes toa particular unit divides to supply nitrogen to both thedrywell and suppression chamber. The intent of thisarrangement is to provide redundant nitrogen supplies toboth the drywell and suppression chamber to satisfy singlefailure criteria. In order to purge primary containment ofcombustible gases, the original CAD System design providedtwo vents for each unit. One is to allow venting from thedrywell and the other is to allow venting from thesuppression chamber. The nitrogen storage tank contains3841 gallons (which corresponds to a level of 33 incheswater column), which is adequate for 7 days of CAD Systemand Safety Grade Instrument Gas (SGIG) System operation forboth units.

The SGIG System supplies pressurized nitrogen gas (from theCAD System liquid nitrogen storage tank) as a safety gradepneumatic source to the Containment Atmospheric Control(CAC) System purge and exhaust isolation valve inflatableseals, the reactor building-to-suppression chamber vacuumbreaker air operated isolation valves and inflatable seal,and the CAC and CAD Systems vent control air operatedvalves. The SGIG System thus performs two distinct post-

(continued)


CAD SystemB 3.6.3.1

BASES


LOCA functions: (1) supports containment isolation and (2)supports CAD System vent operation. SGIG System requirementsare addressed for each of the supported system and componentsin LCO 3.6.1.3, "Primary Containment Isolation Valves(PCIVs)," LCO 3.6.1.5, "Reactor Building-to-SuppressionChamber Vacuum Breakers," and LCO 3.6.3.1, "ContainmentAtmospheric Dilution (CAD) System." For the SGIG System,liquid nitrogen from the CAD System liquid nitrogen storagetank passes through the CAD System liquid nitrogen vaporizerwhere it is converted to a gas. The gas then flows into aUnit 2 header and a Unit 3 header separated by two manualglobe valves. From each header, the gas then branches toeach valve operator or valve seal supplied by the SGIGSystem. Each branch is separated from the header by a manualglobe valve and a check valve.

The CAD System operates as directed in the emergencyoperating procedures to remove combustible gases from primarycontainment.


The CAD System is manually initiated from the main controlroom in the purge mode as directed by the emergency operatingprocedures (EOPs), if it is determined that the concentrationof combustible gases in primary containment exceeds theaction levels specified in the EOPs. The CAD System is usedas directed in the EOPs, and when oxygen generation ratesexceed the design basis assumptions.

The CAD System was originally designed to dilute containmentoxygen by repressurizing primary containment with nitrogen toapproximately 50% of the containment design pressure. Abovethis pressure, containment would be vented to maintain thispressure while CAD continued to supply diluting nitrogen.The original design calculations demonstrated that, withoxygen generation rates specified in Regulatory Guide 1.7,Table 1 (Reference 3), and the CAD system operated per itsoriginal design mode (i.e., repressurization), oxygenconcentrations would be maintained < 5 v/o and offsite doseswould be maintained less than the requirements of 10CFR50.44.

The PBAPS combustible gas control system has since beenreevaluated with oxygen generation rates based onexperimentally and analytically determined parameters aspermitted in Regulatory Guide 1.7, and documented in NEDO-22155 and Reference 1. As a result it was found that theprimary containment inerting alone is sufficient to maintainoxygen concentrations < 5 v/o and that CAD system operationwould not be required to control combustible gases.Therefore, the CAD system, and in particular containmentventing, is no longer considered the primary means ofcombustible gas control. As a result, no releases or offsitedoses are anticipated to result from design basis combustiblegas control.

(continued)


CAD SystemB 3.6.3.1

BASES

APPLICABLE Nevertheless, Reference 1 did direct that the CAD System beSAFETY ANALYSES maintained as it was originally designed to comply with the

(continued) requirements of criteria 41, 42, and 43 of Appendix A of 10CFR Part 50 and installed in accordance with IOCFR50.44(Reference 2).

The CAD System satisfies the requirements of NRC PolicyStatement (Reference 5) because through Reference 1 review,the CAD System has been determined to be important to publichealth and safety. Thus, it is retained in the TechnicalSpecifications.

LCO Two CAD subsystems must be OPERABLE. This ensures operationof at least one CAD subsystem in the event of a worst casesingle active failure. Operation of at least one CADsubsystem is designed to maintain primary containment post-LOCA oxygen concentration < 5.0 v/o for 7 days.

For the CAD System vent control air operated valves and theCAC System vent control air operated valves which supportCAD System operation to be considered OPERABLE, the SGIGSystem supplying nitrogen gas to the air operators of thesevalves must be OPERABLE.

APPLICABILITY In MODES 1 and 2, the CAD System is required to maintain theoxygen concentration within primary containment below theflammability limit of 5.0 v/o following a LOCA. Thisensures that the relative leak tightness of primarycontainment is adequate and prevents damage to safetyrelated equipment and instruments located within primarycontainment.

In MODE 3, both the hydrogen and oxygen production rates andthe total amounts produced after a LOCA would be less thanthose calculated for the Design Basis Accident LOCA. Thus,if the analysis were to be performed starting with a LOCA inMODE 3, the time to reach a flammable concentration would beextended beyond the time conservatively calculated forMODES 1 and 2. The extended time would allow hydrogenremoval from the primary containment atmosphere by othermeans and also allow repair of an inoperable CAD subsystem,if CAD were not available. Therefore, the CAD System is notrequired to be OPERABLE in MODE 3.

In MODES 4 and 5, the probability and consequences of a LOCAare reduced due to the pressure and temperature limitationsof these MODES. Therefore, the CAD System is not requiredto be OPERABLE in MODES 4 and 5.

ACTIONS A.1

If one or both CAD subsystems (or one or more supply andvent paths) are inoperable, both subsystems must be restoredto OPERABLE status within 30 days. In this Condition, theoxygen control function of the CAD System may be lost.However, alternate oxygen control capabilities may beprovided by the Primary Containment Inerting System. The

(continued)


CAD SystemB 3.6.3.1

BASES


30 day Completion Time is based on the low probability ofthe occurrence of a LOCA that would generate hydrogen andoxygen in amounts capable of exceeding the flammabilitylimit, the amount of time available after the event foroperator action to prevent exceeding this limit, and theavailability of other hydrogen mitigating systems.

B.1

If any Required Action cannot be met within the associatedCompletion Time, the plant must be brought to a MODE inwhich the LCO does not apply. To achieve this status, theplant must be brought to at least MODE 3 within 12 hours.The allowed Completion Time of 12 hours is reasonable, basedon operating experience, to reach MODE 3 from full powerconditions in an orderly manner and without challengingplant systems.


This SR ensures that the pressure in the SGIG System headeris Ž 80 psig. This ensures that the post-LOCA nitrogenpressure provided to the valve operators and valve seals isadequate for the SGIG System to perform its design function.The 24 hour Frequency was developed considering theimportance of the SGIG System for maintaining thecontainment isolation function and combustible gas controlfunction of valves supplied by the SGIG System. The 24 hourFrequency is also considered to be adequate to ensure timelydetection of any breach in the SGIG System which wouldrender the system incapable of performing its function.

(continued)


CAD SystemB 3.6.3.1

BASES


(continued)

SR 3.6.3.1.2

Verifying that the level in the CAD liquid nitrogen tank is> 33 inches water column will ensure at least 7 days ofpost-LOCA CAD System and SGIG System operation for bothunits. This minimum volume of liquid nitrogen allowssufficient time after an accident to replenish the nitrogensupply for long term inerting. This is verified every24 hours to ensure that the system is capable of performingits intended function when required. The 24 hour Frequencyis based on operating experience, which has shown 24 hoursto be an acceptable period to verify the liquid nitrogensupply and on the availability of other hydrogen mitigatingsystems.

SR 3.6.3.1.3

Verifying the correct alignment for manual, power operated,and automatic valves in each of the CAD subsystem flow pathsprovides assurance that the proper flow paths exist forsystem operation. This SR does not apply to valves that arelocked, sealed, or otherwise secured in position, sincethese valves were verified to be in the correct positionprior to locking, sealing, or securing.

A valve is also allowed to be in the nonaccident positionprovided it can be aligned to the accident position withinthe time assumed in the accident analysis. This isacceptable because the CAD System is manually initiated.This SR does not apply to valves that cannot beinadvertently misaligned, such as check valves. This SRdoes not require any testing or valve manipulation; rather,it involves verification that those valves capable of beingmispositioned are in the correct position.

The 31 day Frequency is appropriate because the valves areoperated under procedural control, improper valve positionwould only affect a single subsystem, the probability of anevent requiring initiation of the system is low, and thesystem is a manually initiated system.

(continued)


CAD SystemB 3.6.3.1

BASES


(continued)

SR 3.6.3.1.4

Verifying the correct alignment for each manual valve in theSGIG System required flow paths provides assurance that theproper flow paths exist for system operation. This SR doesnot apply to valves that are locked or otherwise secured inposition, since these valves were verified to be in thecorrect position prior to locking or securing. A valve isalso allowed to be in the nonaccident position provided itcan be aligned to the accident position within the timeassumed in the accident analysis. This is acceptablebecause the CAD System is manually initiated. This SR doesnot apply to valves that cannot be inadvertently misalignedsuch as check valves. This SR does not require any testingor valve manipulation; rather, it involves verification thatthose valves capable of being mispositioned are in thecorrect position. The 31 day Frequency is based onengineering judgment, is consistent with the proceduralcontrols governing valve operation, and ensures correctvalve positions.

SR 3.6.3.1.5

This SR ensures that in case the non-safety grade instrumentair system is unavailable, the SGIG System will perform itsdesign function to supply nitrogen gas at the requiredpressure for valve operators and valve seals supported bythe SGIG System. The 24 month Frequency was developedconsidering it is prudent that this Surveillance beperformed only during a plant outage. Operating experiencehas shown that these components will usually pass thisSurveillance when performed at the 24 month Frequency.Thus, the Frequency was concluded to be acceptable from areliability standpoint.

REFERENCES 1. Nuclear Regulatory Commission (NRC) Letter (SER) fromJohn E. Stolz (Chief, Operating Reactors Branch(Division of Licensing)) to Edward G. Bauer, Jr., VicePresident and General Counsel, Philadelphia ElectricCompany "Recombiner Capability Requirements ofI0CFR50.44(c) (3) (ii) Generic Letter 84-09" dated6/26/85.

2. 10 CFR Part 50.

3. Regulatory Guide 1.7, Revision 0.


5. Final Policy statement on Technical SpecificationImprovements July 22, 1993 (58 FR3913)


Primary Containment Oxygen ConcentrationB 3.6.3.2


B 3.6.3.2 Primary Containment Oxygen Concentration

BASES

BACKGROUND All nuclear reactors must be designed to withstand eventsthat generate hydrogen either due to the zirconium metalwater reaction in the core or due to radiolysis. Theprimary method to control hydrogen is to inert the primarycontainment. With the primary containment inert, that is,oxygen concentration < 4.0 volume percent (v/o), acombustible mixture cannot be present in the primarycontainment for any hydrogen concentration. The capabilityto inert the primary containment and maintain oxygen< 4.0 v/o works together with the Containment AtmosphericDilution System (LCO 3.6.3.1, "Containment AtmosphericDilution (CAD) System) to provide redundant and diversemethods to mitigate events that produce hydrogen. Forexample, an event that rapidly generates hydrogen fromzirconium metal water reaction will result in excessivehydrogen in primary containment, but oxygen concentrationwill remain < 4.0 v/o and no combustion can occur. Longterm generation of both hydrogen and oxygen from radiolyticdecomposition of water may eventually result in acombustible mixture in primary containment, except that theCAD System dilutes and removes hydrogen and oxygen gasesfaster than they can be produced from radiolysis and againno combustion can occur. This LCO ensures that oxygenconcentration does not exceed 4.0 v/o during operation inthe applicable conditions.


The Reference I calculations assume that the primarycontainment is inerted when a Design Basis Accident loss ofcoolant accident occurs. Thus, the hydrogen assumed to bereleased to the primary containment as a result of metalwater reaction in the reactor core will not producecombustible gas mixtures in the primary containment.Oxygen, which is subsequently generated by radiolyticdecomposition of water, is diluted and removed by the CADSystem more rapidly than it is produced.

Primary containment oxygen concentration satisfiesCriterion 2 of the NRC Policy Statement.

(continued)



BASES (continued)

LCO The primary containment oxygen concentration is maintained< 4.0 v/o to ensure that an event that produces any amountof hydrogen does not result in a combustible mixture insideprimary containment.

APPLICABILITY The primary containment oxygen concentration must be withinthe specified limit when primary containment is inerted,except as allowed by the relaxations during startup andshutdown addressed below. The primary containment must beinert in MODE 1, since this is the condition with thehighest probability of an event that could produce hydrogen.

Inerting the primary containment is an operational problembecause it prevents containment access without anappropriate breathing apparatus. Therefore, the primarycontainment is inerted as late as possible in the plantstartup and de-inerted as soon as possible in the plantshutdown. As long as reactor power is < 15% RTP, thepotential for an event that generates significant hydrogenis low and the primary containment need not be inert.Furthermore, the probability of an event that generateshydrogen occurring within the first 24 hours of a startup,or within the last 24 hours before a shutdown, is low enoughthat these "windows," when the primary containment is notinerted, are also justified. The 24 hour time period is areasonable amount of time to allow plant personnel toperform inerting or de-inerting.

ACTIONS A.1

If oxygen concentration is ? 4.0 v/o at any time whileoperating in MODE 1, with the exception of the relaxationsallowed during startup and shutdown, oxygen concentrationmust be restored to < 4.0 v/o within 24 hours. The 24 hourCompletion Time is allowed when oxygen concentration isZ 4.0 v/o because of the availability of other hydrogenmitigating systems (e.g., the CAD System) and the lowprobability and long duration of an event that wouldgenerate significant amounts of hydrogen occurring duringthis period.

(continued)



BASES

ACTIONS B.I1(continued)

If oxygen concentration cannot be restored to within limitswithin the required Completion Time, the plant must bebrought to a MODE in which the LCO does not apply. Toachieve this status, power must be reduced to : 15% RTPwithin 8 hours. The 8 hour Completion Time is reasonable,based on operating experience, to reduce reactor power fromfull power conditions in an orderly manner and withoutchallenging plant systems.


The primary containment (drywell and suppression chamber)must be determined to be inert by verifying that oxygenconcentration is < 4.0 v/o. The 7 day Frequency is based onthe slow rate at which oxygen concentration can change andon other indications of abnormal conditions (which wouldlead to more frequent checking by operators in accordancewith plant procedures). Also, this Frequency has been shownto be acceptable through operating experience.

REFERENCES 1. UFSAR, Section 5.2.3.9.5.


Secondary ContainmentB 3.6.4.1


B 3.6.4.1 Secondary Containment

BASES

BACKGROUND The function of the secondary containment is to contain andhold up fission products that may leak from primarycontainment following a Design Basis Accident (DBA). Inconjunction with operation of the Standby Gas Treatment(SGT) System and closure of certain valves whose linespenetrate the secondary containment, the secondarycontainment is designed to reduce the activity level of thefission products prior to release to the environment and toisolate and contain fission products that are releasedduring certain operations that take place inside primarycontainment, when primary containment is not required to beOPERABLE, or that take place outside primary containment.

The secondary containment is a structure that completelyencloses the primary containment and those components thatmay be postulated to contain primary system fluid. Thisstructure forms a control volume that serves to hold up anddilute the fission products. It is possible for thepressure in the control volume to rise relative to theenvironmental pressure (e.g., due to pump and motor heatload additions). To prevent ground level exfiltration whileallowing the secondary containment to be designed as aconventional structure, the secondary containment requiressupport systems to maintain the control volume pressure atless than the external pressure. Requirements for thesesystems are specified separately in LCO 3.6.4.2, "SecondaryContainment Isolation Valves (SCIVs)," and LCO 3.6.4.3,"Standby Gas Treatment (SGT) System."

APPLICABLE There are two principal accidents for which credit is takenSAFETY ANALYSES for secondary containment OPERABILITY. These are a loss of

coolant accident (LOCA) (Ref. 1) and a fuel handlingaccident inside secondary containment (Ref. 2). Thesecondary containment performs no active function inresponse to each of these limiting events; however, its leak

(continued)



BASES

APPLICABLE tightness is required to ensure that fission productsSAFETY ANALYSES entrapped within the secondary containment structure will be

(continued) treated by the SGT System prior to discharge to theenvironment.

Secondary containment satisfies Criterion 3 of the NRCPolicy Statement.

LCO An OPERABLE secondary containment provides a control volumeinto which fission products that leak from primarycontainment, or are released from the reactor coolantpressure boundary components located in secondarycontainment, can be processed prior to release to theenvironment. For the secondary containment to be consideredOPERABLE, it must have adequate leak tightness to ensurethat the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission productrelease to primary Containment that leaks to secondarycontainment. Therefore, secondary containment OPERABILITYis required during the same operating conditions thatrequire primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of theLOCA are reduced due to the pressure and temperaturelimitations in these MODES. Therefore, maintainingsecondary containment OPERABLE is not required in MODE 4or 5 to ensure a control volume, except for other situationsfor which significant releases of radioactive material canbe postulated, such as during operations with a potentialfor draining the reactor vessel (OPDRVs), during COREALTERATIONS, or during movement of irradiated fuelassemblies in the secondary containment.

ACTIONS A.1

If secondary containment is inoperable, it must be restoredto OPERABLE status within 4 hours. The 4 hour CompletionTime provides a period of time to correct the problem thatis commensurate with the importance of maintaining secondarycontainment during MODES 1, 2, and 3. This time period alsoensures that the probability of an accident (requiringsecondary containment OPERABILITY) occurring during periodswhere secondary containment is inoperable is minimal.

(continued)

0



BASES


If secondary containment cannot be restored to OPERABLEstatus within the required Completion Time, the plant mustbe brought to a MODE in which the LCO does not apply. Toachieve this status, the plant must be brought to at leastMODE 3 within 12 hours and to MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.

C.A, C.2. and C.3

Movement of irradiated fuel assemblies in the secondarycontainment, CORE ALTERATIONS, and OPDRVs can be postulatedto cause fission product release to the secondarycontainment. In such cases, the secondary containment isthe only barrier to release of fission products to theenvironment. CORE ALTERATIONS and movement of irradiatedfuel assemblies must be immediately suspended if thesecondary containment is inoperable.

Suspension of these activities shall not preclude completingan action that involves moving a component to a safeposition. Also, action must be immediately initiated tosuspend OPDRVs to minimize the probability of a vesseldraindown and subsequent potential for fission productrelease. Actions must continue until OPDRVs are suspended.

Required Action C.1 has been modified by a Note stating thatLCO 3.0.3 is not applicable. If moving irradiated fuelassemblies while in MODE 4 or 5, LCO 3.0.3 would not specifyany action. If moving irradiated fuel assemblies while inMODE 1, 2, or 3, the fuel movement is independent of reactoroperations. Therefore, in either case, inability to suspendmovement of irradiated fuel assemblies would not be asufficient reason to require a reactor shutdown.

(continued)



BASES (continued)

SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2REQUIREMENTS

Verifying that secondary containment equipment hatches andone access door in each access opening are closed ensuresthat the infiltration of outside air of such a magnitude asto prevent maintaining the desired negative pressure doesnot occur. Verifying that all such openings are closedprovides adequate assurance that exfiltration from thesecondary containment will not occur. In this application,the term "sealed" has no connotation of leak tightness.Maintaining secondary containment OPERABILITY requiresverifying one door in the access opening is closed. Anaccess opening contains one inner and one outer door. Insome cases, secondary containment access openings are sharedsuch that a secondary containment barrier may have multipleinner or multiple outer doors. The intent is to not breachsecondary containment at any time when secondary containmentis required. This is achieved by maintaining the inner orouter portion of the barrier closed at all times. However,all secondary containment access doors are normally keptclosed, except when the access opening is being used forentry and exit or when maintenance is being performed on anaccess opening. The 31 day Frequency for these SRs has beenshown to be adequate, based on operating experience, and isconsidered adequate in view of the other indications of doorand hatch status that are available to the operator.

SR 3.6.4.1.3 and SR 3.6.4.1.4

The SGT System exhausts the secondary containment atmosphereto the environment through appropriate treatment equipment.Each SGT subsystem is designed to draw down pressure in thesecondary containment to Ž 0.25 inches of vacuum water gaugein • 120 seconds and maintain pressure in the secondarycontainment at Ž 0.25 inches of vacuum water gauge for 1 hourat a flow rate • 10,500 cfm. To ensure that all fissionproducts released to the secondary containment are treated,SR 3.6.4.1.3 and SR 3.6.4.1.4 verify that a pressure in thesecondary containment that is less than the lowest postulatedpressure external to the secondary containment boundary canrapidly be established and maintained. When the SGT Systemis operating as designed, the establishment and maintenanceof secondary containment pressure cannot be accomplished ifthe secondary containment boundary is not intact.Establishment of this pressure is confirmed by SR 3.6.4.1.3which demonstrates that the secondary containment can bedrawn down to Ž 0.25 inches of vacuum water gauge in • 120

(continued)



BASES


seconds using one SGT subsystem. SR 3.6.4.1.4 demonstratesthat the pressure in the secondary containment can bemaintained Ž 0.25 inches of vacuum water gauge for 1 hourusing one SGT subsystem at a flow rate • 10,500 cfm. The 1hour test period allows secondary containment to be inthermal equilibrium at steady state conditions. The primarypurpose of these SRs is to ensure secondary containmentboundary integrity. The secondary purpose of these SRs isto ensure that the SGT subsystem being tested functions asdesigned. There is a Separate LCO with SurveillanceRequirements which serves the primary purpose of ensuringOPERABLITY of the SGT System. These SRs need not beperformed with each SGT subsystem. The SGT subsystem usedfor these Surveillances is staggered to ensure that inaddition to the requirements of LCO 3.6.4.3, either SGTsubsystem will perform this test. The inoperability of theSGT System does not necessarily constitute a failure ofthese Surveillances relative to the secondary containmentOPERABILITY. Operating experience has shown the secondarycontainment boundary usually passes these Surveillances whenperformed at the 24 month Frequency. Therefore, theFrequency was concluded to be acceptable from a reliabilitystandpoint.




SCIVsB 3.6.4.2


B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs)

BASES

BACKGROUND The function of the SCIVs, in combination with otheraccident mitigation systems, is to limit fission productrelease during and following postulated Design BasisAccidents (DBAs) (Refs. 1 and 2). Secondary containmentisolation within the time limits specified for thoseisolation valves designed to close automatically ensuresthat fission products that leak from primary containmentfollowing a DBA, or that are released during certainoperations when primary containment is not required to beOPERABLE or take place outside primary containment, aremaintained within the secondary containment boundary.

The OPERABILITY requirements for SCIVs help ensure that anadequate secondary containment boundary is maintained duringand after an accident by minimizing potential paths to theenvironment. These isolation devices consist of eitherpassive devices or active (automatic) devices. Manualvalves, de-activated automatic valves secured in theirclosed position (including check valves with flow throughthe valve secured), and blind flanges are considered passivedevices.

Automatic SCIVs close on a secondary containment isolationsignal to establish a boundary for untreated radioactivematerial within secondary containment following a DBA orother accidents.

Other penetrations are isolated by the use of valves in theclosed position or blind flanges.

APPLICABLE The SCIVs must be OPERABLE to ensure the secondarySAFETY ANALYSES containment barrier to fission product releases is

established. The principal accidents for which thesecondary containment boundary is required are a loss ofcoolant accident (Ref. 1) and a fuel handling accidentinside secondary containment (Ref. 2). The secondarycontainment performs no active function in response toeither of these limiting events, but the boundary

(continued)


SCIVsB 3.6.4.2

BASES

APPLICABLE established by SCIVs is required to ensure that leakage fromSAFETY ANALYSES the primary containment is processed by the Standby Gas

(continued) Treatment (SGT) System before being released to theenvironment.

Maintaining SCIVs OPERABLE with isolation times withinlimits ensures that fission products will remain trappedinside secondary containment so that they can be treated bythe SGT System prior to discharge to the environment.

SCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO SCIVs form a part of the secondary containment boundary.The SCIV safety function is related to control of offsiteradiation releases resulting from DBAs.

The power operated automatic isolation valves are consideredOPERABLE when their isolation times are within limits andthe valves actuate on an automatic isolation signal. Thevalves covered by this LCO, along with their associatedstroke times, are listed in Reference 3.

The normally closed isolation valves or blind flanges areconsidered OPERABLE when manual valves are closed or open inaccordance with appropriate administrative controls,automatic SCIVs are de-activated and secured in their closedposition, and blind flanges are in place. These passiveisolation valves or devices are listed in Reference 3.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission productrelease to the primary containment that leaks to thesecondary containment. Therefore, the OPERABILITY of SCIVsis required.

In MODES 4 and 5, the probability and consequences of theseevents are reduced due to pressure and temperaturelimitations in these MODES. Therefore, maintaining SCIVsOPERABLE is not required in MODE 4 or 5, except for othersituations under which significant radioactive releases canbe postulated, such as during operations with a potentialfor draining the reactor vessel (OPDRVs), during COREALTERATIONS, or during movement of irradiated fuelassemblies in the secondary containment. Moving irradiatedfuel assemblies in the secondary containment may also occurin MODES 1, 2, and 3.

(continued)


SCIVsB 3.6.4.2

BASES (continued)

ACTIONS The ACTIONS are modified by three Notes. The first Noteallows penetration flow paths to be unisolatedintermittently under administrative controls. Thesecontrols consist of stationing a dedicated operator, who isin continuous communication with the control room, at thecontrols of the isolation device. In this way, thepenetration can be rapidly isolated when a need forsecondary containment isolation is indicated.

The second Note provides clarification that for the purposeof this LCO separate Condition entry is allowed for eachpenetration flow path. This is acceptable, since theRequired Actions for each Condition provide appropriatecompensatory actions for each inoperable SCIV. Complyingwith the Required Actions may allow for continued operation,and subsequent inoperable SCIVs are governed by subsequentCondition entry and application of associated RequiredActions.

The third Note ensures appropriate remedial actions aretaken, if necessary, if the affected system(s) are renderedinoperable by an inoperable SCIV.

A.1 and A.2

In the event that there are one or more penetration flowpaths with one SCIV inoperable, the affected penetrationflow path(s) must be isolated. The method of isolation mustinclude the use of at least one isolation barrier thatcannot be adversely affected by a single active failure.Isolation barriers that meet this criterion are a closed andde-activated automatic SCIV, a closed manual valve, and ablind flange. For penetrations isolated in accordance withRequired Action A.1, the device used to isolate thepenetration should be the closest available device tosecondary containment. The Required Action must becompleted within the 8 hour Completion Time. The specifiedtime period is reasonable considering the time required toisolate the penetration, and the probability of a DBA, whichrequires the SCIVs to close, occurring during this shorttime is very low.

For affected penetrations that have been isolated inaccordance with Required Action A.1, the affectedpenetration must be verified to be isolated on a periodicbasis. This is necessary to ensure that secondary

(continued)


SCIVsB 3.6.4.2

BASES


containment penetrations required to be isolated followingan accident, but no longer capable of being automaticallyisolated, will be in the isolation position should an eventoccur. The Completion Time of once per 31 days isappropriate because the isolation devices are operated underadministrative controls and the probability of theirmisalignment is low. This Required Action does not requireany testing or device manipulation. Rather, it involvesverification that the affected penetration remains isolated.

Required Action A.2 is modified by two Notes. Note Iapplies to devices located in high radiation areas andallows them to be verified closed by use of administrativecontrols. Allowing verification by administrative controlsis considered acceptable, since access to these areas istypically restricted. Note 2 applies to isolation devicesthat are locked, sealed, or otherwise secured in positionand allows these devices to be verified closed by use ofadministrative means. Allowing verification byadministrative means is considered acceptable, since thefunction of locking, sealing, or securing components is toensure that these devices are not inadvertentlyrepositioned. Therefore, the probability of misalignment,once they have been verified to be in the proper position,is low.

B.1

With two SCIVs in one or more penetration flow pathsinoperable, the affected penetration flow path must beisolated within 4 hours. The method of isolation mustinclude the use of at least one isolation barrier thatcannot be adversely affected by a single active failure.Isolation barriers that meet this criterion are a closed and,de-activated automatic valve, a closed manual valve, and ablind flange. The 4 hour Completion Time is reasonableconsidering the time required to isolate the penetration andthe probability of a DBA, which requires the SCIVs to close,occurring during this short time, is very low.

The Condition has been modified by a Note stating thatCondition B is only applicable to penetration flow pathswith two isolation valves. This clarifies that onlyCondition A is entered if one SCIV is inoperable in each oftwo penetrations.

(continued)


SCIVsB 3.6.4.2

BASES

ACTIONS C.1 and C.2(continued)

If any Required Action and associated Completion Time cannotbe met, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 12 hours and to MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.

D.1, D.2. and D.3

If any Required Action and associated Completion Time arenot met, the plant must be placed in a condition in whichthe LCO does not apply. If applicable, CORE ALTERATIONS andthe movement of irradiated fuel assemblies in the secondarycontainment must be immediately suspended. Suspension ofthese activities shall not preclude completion of movementof a component to a safe position. Also, if applicable,actions must be immediately initiated to suspend OPDRVs inorder to minimize the probability of a vessel draindown andthe subsequent potential for fission product release.Actions must continue until OPDRVs are suspended.

Required Action D.1 has been modified by a Note stating thatLCO 3.0.3 is not applicable. If moving irradiated fuelassemblies while in MODE 4 or 5, LCO 3.0.3 would not specifyany action. If moving fuel while in MODE 1, 2, or 3, thefuel movement is independent of reactor operations.Therefore, in either case, inability to suspend movement ofirradiated fuel assemblies would not be a sufficient reasonto require a reactor shutdown.


This SR verifies that each secondary containment manualisolation valve and blind flange that is not locked, sealed,or otherwise secured and is required to be closed duringaccident conditions is closed. The SR helps to ensure thatpost accident leakage of radioactive fluids or gases outsideof the secondary containment boundary is within designlimits. This SR does not require any testing or valvemanipulation. Rather, it involves verification that thoseSCIVs in secondary containment that are capable of beingmispositioned are in the correct position.

(continued)


SCIVsB 3.6.4.2

BASES


Since these SCIVs are readily accessible to personnel duringnormal operation and verification of their position isrelatively easy, the 31 day Frequency was chosen toprovide added assurance that the SCIVs are in the correctpositions. This SR does not apply to valves that are locked,sealed, or otherwise secured in the closed position, sincethese were verified to be in the correct position uponlocking, sealing, or securing.

Two Notes have been added to this SR. The first Noteapplies to valves and blind flanges located in highradiation areas and allows them to be verified by use ofadministrative controls. Allowing verification byadministrative controls is considered acceptable, sinceaccess to these areas is typically restricted duringMODES 1, 2, and 3 for ALARA reasons. Therefore, theprobability of misalignment of these SCIVs, once they havebeen verified to be in the proper position, is low.

A second Note has been included to clarify that SCIVs thatare open under administrative controls are not required tomeet the SR during the time the SCIVs are open.

SR 3.6.4.2.2

Verifying that the isolation time of each power operatedautomatic SCIV is within limits is required to demonstrateOPERABILITY. The isolation time test ensures that the SCIVwill isolate in a time period less than or equal to thatassumed in the safety analyses. The Frequency of this SR isin accordance with the Inservice Testing Program.

SR 3.6.4.2.3

Verifying that each automatic SCIV closes on a secondarycontainment isolation signal is required to prevent leakageof radioactive material from secondary containment followinga DBA or other accidents. This SR ensures that eachautomatic SCIV will actuate to the isolation position on asecondary containment isolation signal. The LOGIC SYSTEMFUNCTIONAL TEST in LCO 3.3.6.2, "Secondary ContainmentIsolation Instrumentation," overlaps this SR to providecomplete testing of the safety function. The 24 monthFrequency is based on the need to perform this Surveillance

(continued)


SCIVsB 3.6.4.2

BASES


under the conditions that apply during a plant outage andthe potential for an unplanned transient if'the Surveillancewere performed with the reactor at power. Operatingexperience has shown these components will usually passthe Surveillance when performed at the 24 month Frequency.Therefore, the Frequency was concluded to be acceptable froma reliability standpoint.



3. Technical Requirements Manual.


SGT SystemB 3.6.4.3


B 3.6.4.3 Standby Gas Treatment (SGT) System

BASES

BACKGROUND The SGT System is required by UFSAR design criteria(Ref. 1). The function of the SGT System is to ensure thatradioactive materials that leak from the primary containmentinto the secondary containment following a Design BasisAccident (DBA) are filtered and adsorbed prior to exhaustingto the environment.

A single SGT System is common to both Unit 2 and Unit 3 andconsists of two fully redundant subsystems, each with itsown set of ductwork, dampers, valves, charcoal filter train,and controls. Both SGT subsystems share a common inletplenum. This inlet plenum is connected to the refuelingfloor ventilation exhaust duct for each Unit and to thesuppression chamber and drywell of each Unit. Both SGTsubsystems exhaust to the plant offgas stack through acommon exhaust duct served by three 100% capacity systemfans. SGT System fans OAV020 and OBV020 automatically starton Unit 2 secondary containment isolation signals. SGTSystem fans OCV020 and OBVO20 automatically start on Unit 3secondary containment isolation signals.

Each charcoal filter train consists of (components listed inorder of the direction of the air flow):

a. A demister or moisture separator;

b. An electric heater;

c. A prefilter;

d. A high efficiency particulate air (HEPA) filter;

e. A charcoal adsorber; and

f. A second HEPA filter.

The SGT System is sized such that each 100% capacity fanwill provide a flow rate of 10,500 cfm at 20 inches watergauge static pressure to support the control of fissionproduct releases. The SGT System is designed to restore andmaintain secondary containment at a negative pressure of0.25 inches water gauge relative to the atmosphere following

(continued)


SGT SystemB 3.6.4.3

BASES


the receipt of a secondary containment isolation signal.Maintaining this negative pressure is based upon theexistence of calm wind conditions (up to 5 mph), a maximumSGT System flow rate of 10,500 cfm, outside air temperatureof 95"F and a temperature of 150"F for air entering the SGTSystem from inside secondary containment.

The demister is provided to remove entrained water in theair, while the electric heater reduces the relative humidityof the airstream to less than 70% (Ref. 2). The prefilterremoves large particulate matter, while the HEPA filterremoves fine particulate matter and protects the charcoalfrom fouling. The charcoal adsorber removes gaseouselemental iodine and organic iodides, and the final HEPAfilter collects any carbon fines exhausted from the charcoaladsorber.

The SGT System automatically starts and operates in responseto actuation signals indicative of conditions or an accidentthat could require operation of the system. Followinginitiation, two charcoal filter train fans (OAV020 andOBV020) start. Upon verification that both subsystems areoperating, the redundant subsystem is normally shut down.

APPLICABLE The design basis for the SGT System is to mitigate theSAFETY ANALYSES consequences of a loss of coolant accident and fuel handling

accidents (Ref. 2). For all events analyzed, the SGT Systemis shown to be automatically initiated to reduce, viafiltration and adsorption, the radioactive material releasedto the environment.

The SGT System satisfies Criterion 3 of the NRC PolicyStatement.

LCO Following a DBA, a minimum of one SGT subsystem is requiredto maintain the secondary containment at a negative pressurewith respect to the environment and to process gaseousreleases. Meeting the LCO requirements for two OPERABLEsubsystems ensures operation of at least one SGT subsystemin the event of a single active failure.

(continued)


SGT SystemB 3.6.4.3

BASES

LCO For Unit 2, one SGT subsystem is OPERABLE when one charcoal(continued) filter train, one fan (OAV020) and associated ductwork,

dampers, valves, and controls are OPERABLE. The second SGTsubsystem is OPERABLE when the other charcoal filter train,one fan (OBV020) and associated ductwork, damper, valves,and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission productrelease to primary containment that leaks to secondarycontainment. Therefore, SGT System OPERABILITY is requiredduring these MODES.

In MODES 4 and 5, the probability and consequences of theseevents are reduced due to the pressure and temperaturelimitations in these MODES. Therefore, maintaining the SGTSystem in OPERABLE status is not required in MODE 4 or 5,except for other situations under which significant releasesof radioactive material can be postulated, such as duringoperations with a potential for draining the reactor vessel(OPDRVs), during CORE ALTERATIONS, or during movement ofirradiated fuel assemblies in the secondary containment.

ACTIONS A.1

With one SGT subsystem inoperable, the inoperable subsystemmust be restored to OPERABLE status in 7 days. In thisCondition, the remaining OPERABLE SGT subsystem is adequateto perform the required radioactivity release controlfunction. However, the overall system reliability isreduced because a single failure in the OPERABLE subsystemcould result in the radioactivity release control functionnot being adequately performed. The 7 day Completion Timeis based on consideration of such factors as theavailability of the OPERABLE redundant SGT subsystem and thelow probability of a DBA occurring during this period.

B.1 and B.2

If the SGT subsystem cannot be restored to OPERABLE statuswithin the required Completion Time in MODE 1, 2, or 3, theplant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought toat least MODE 3 within 12 hours and to MODE 4 within

(continued)


SGT SystemB 3.6.4.3

BASES


36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems.

C.I. C.2.1, C.2.2. and C.2.3

During movement of irradiated fuel assemblies, in thesecondary containment, during CORE ALTERATIONS, or duringOPDRVs, when Required Action A.] cannot be completed withinthe required Completion Time, the OPERABLE SGT subsystemshould immediately be placed in operation. This actionensures that the remaining subsystem is OPERABLE, that nofailures that could prevent automatic actuation haveoccurred, and that any other failure would be readilydetected.

An alternative to Required Action C.] is to immediatelysuspend activities that represent a potential for releasingradioactive material to the secondary containment, thusplacing the plant in a condition that minimizes risk. Ifapplicable, CORE ALTERATIONS and movement of irradiated fuelassemblies must immediately be suspended. Suspension ofthese activities must not preclude completion of movement ofa component to a safe position. Also, if applicable,actions must immediately be initiated to suspend OPDRVs inorder to minimize the probability of a vessel draindown andsubsequent potential for fission product release. Actionsmust continue until OPDRVs are suspended.

The Required Actions of Condition C have been modified by aNote stating that LCO 3.0.3 is not applicable. If movingirradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3would not specify any action. If moving irradiated fuelassemblies while in MODE 1, 2, or 3, the fuel movement isindependent of reactor operations. Therefore, in eithercase, inability to suspend movement of irradiated fuelassemblies would not be a sufficient reason to require areactor shutdown.

(continued)


SGT SystemB 3.6.4.3

BASES

ACTIONS D.1(continued)

If both SGT subsystems are inoperable in MODE 1, 2, or 3,the SGT System may not be capable of supporting the requiredradioactivity release control function. Therefore, actionsare required to enter LCO 3.0.3 immediately.

E.1, E.2, and E.3

When two SGT subsystems are inoperable, if applicable, COREALTERATIONS and movement of irradiated fuel assemblies insecondary containment must immediately be suspended.Suspension of these activities shall not preclude completionof movement of a component to a safe position. Also, ifapplicable, actions must immediately be initiated to suspendOPDRVs in order to minimize the probability of a vesseldraindown and subsequent potential for fission productrelease. Actions must continue until OPDRVs are suspended.

Required Action E.1 has been modified by a Note stating thatLCO 3.0.3 is not applicable. If moving irradiated fuelassemblies while in MODE 4 or 5, LCO 3.0.3 would not specifyany action. If moving irradiated fuel assemblies while inMODE 1, 2, or 3, the fuel movement is independent of reactoroperations. Therefore, in either case, inability to suspendmovement of irradiated fuel assemblies would not be asufficient reason to require a reactor shutdown.


Operating each SGT subsystem (including each filter trainfan) for ; 15 minutes ensures that both subsystems areOPERABLE and that all associated controls are functioningproperly. It also ensures that blockage, fan or motorfailure, or excessive vibration can be detected forcorrective action. Operation with the heaters on (automaticheater cycling to maintain temperature) for 2 15 minutesevery 31 days is sufficient to eliminate moisture on theadsorbers and HEPA filters since during idle periodsinstrument air is injected into the filter plenum to keepthe filters dry. The 31 day Frequency was developed inconsideration of the known reliability of fan motors andcontrols and the redundancy available in the system.

(continuedl


SGT SystemB 3.6.4.3

BASES


(continued)

SR 3.6.4.3.2

This SR verifies that the required SGT filter testing isperformed in accordance with the Ventilation Filter TestingProgram (VFTP). The VFTP includes testing HEPA filterperformance, charcoal adsorber efficiency, minimum systemflow rate, and the physical properties of the activatedcharcoal (general use and following specific operations).Specific test frequencies and additional information arediscussed in detail in the VFTP.

SR 3.6.4.3.3

This SR verifies that each SGT.subsystem starts on receiptof an actual or simulated initiation signal. While thisSurveillance can be performed with the reactor at power,operating experience has shown that these components willusually pass the Surveillance when performed at the 24 monthFrequency. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2,"Secondary Containment Isolation Instrumentation," overlapsthis SR to provide complete testing of the safety function.Therefore, the Frequency was found to be acceptable from areliability standpoint.




HPSW SystemB 3.7.1

B 3.7 PLANT SYSTEMS

B 3.7.1 High Pressure Service Water (HPSW) System

BASES

BACKGROUND The HPSW System is designed to provide cooling water for theResidual Heat Removal (RHR) System heat exchangers, requiredfor a safe reactor shutdown following a Design BasisAccident (DBA) or transient. The HPSW System is operatedwhenever the RHR heat exchangers are required to operate inthe shutdown cooling mode or in the suppression pool coolingor spray mode of the RHR System.

The HPSW System consists of two independent and redundantloops. Each loop is made up of a header, two 4500 gpmpumps, a suction source, valves, piping and associatedinstrumentation. Either of the two loops is capable ofproviding the required cooling capacity with one pumpoperating to maintain safe shutdown conditions. Therefore,there are two HPSW subsystems with each subsystem consistingof a HPSW loop with one OPERABLE HPSW pump in the loop. Thetwo subsystems are separated from each other by normallyclosed motor operated cross tie valves, so that failure ofone subsystem will not affect the OPERABILITY of the othersubsystem. A line connecting the HPSW System of each unitis also provided. Separation of the two units HPSW Systemsis provided by a series of two locked closed, manuallyoperated valves. The HPSW System is designed withsufficient redundancy so that no single active componentfailure can prevent it from achieving its design function.The HPSW System is described in the UFSAR, Section 10.7,Reference I.

Normal cooling water is pumped by the HPSW pumps from theConowingo Pond through the tube side of the RHR heatexchangers, and discharges to the discharge pond. Therequired level for the HPSW pumps in the pump bay of thepump structure is 2 89.5 ft Conowingo Datum (CD) and- 113 ft CD. The minimum level ensures net positive suctionhead and the maximum level corresponds to the level in thepump bay with water solid up to the motor baseplate. Analternate supply and discharge path (from the emergency heatsink) is available in the unlikely event the Conowingo damfails or the pond floods. This lineup, however, has to bemanually aligned.

(continued)


HPSW SystemB 3.7.1

BASES

BACKGROUND The system is initiated manually from the control room. If(continued) operating during a loss of coolant accident (LOCA), the

system is automatically tripped to allow the dieselgenerators to automatically power only that equipmentnecessary to reflood the core. The system is assumed in theanalysis to be manually started 10 minutes after the LOCA.The RHR System design permits the system to be initiated asearly as 5 minutes after LPCI initiation.

APPLICABLE The HPSW System removes heat from the suppression pool toSAFETY ANALYSES limit the suppression pool temperature and primary

containment pressure following a LOCA. This ensures thatthe primary containment can perform its function of limitingthe release of radioactive materials to the environmentfollowing a LOCA. The ability of the HPSW System to supportlong term cooling of the reactor or primary containment isdiscussed in References 2 and 3. These analyses explicitlyassume that the HPSW System will provide adequate coolingsupport to the equipment required for safe shutdown. Theseanalyses include the evaluation of the long term primarycontainment response after a design basis LOCA.

The safety analyses for long term cooling were performed forvarious combinations of RHR System failures. The worst casesingle failure that would affect the performance of the HPSWSystem is any failure that would disable one loop of theHPSW System. As discussed in the UFSAR, Section 14.6.3(Ref. 4) for these analyses, manual initiation of theOPERABLE HPSW subsystem and the associated RHR System isassumed to occur 10 minutes after a DBA. The HPSW flowassumed in the analyses is 4500 gpm with one pump operatingin one loop, providing flow through one RHR heat exchanger.In this case, the maximum suppression chamber watertemperature and pressure are 206"F and approximately33 psig, respectively, well below the design temperature of281"F and maximum allowable pressure of 56 psig.

The HPSW System satisfies Criterion 3 of the NRC PolicyStatement.

LCO Two HPSW subsystems are required to be OPERABLE to providethe required redundancy to ensure that the system functionsto remove post accident heat loads, assuming the worst casesingle active failure occurs coincident with the loss ofoffsite power.

(continued)


HPSW SystemB 3.7.1

BASES

LCO(continued)

A HPSW subsystem is considered OPERABLE when:

a. One pump is OPERABLE; and

b. An OPERABLE flow path is capable of taking suctionfrom the pump structure and transferring the water tothe required RHR heat exchanger at the assumed flowrate.

An adequate suction source is not addressed in this LCOsince the minimum net positive suction head (89.5 ftConowingo Datum (CD) in the pump bay) and normal heat sinktemperature requirements are bounded by the emergencyservice water pump and normal heat sink requirements(LCO 3.7.2, "Emergency Service Water (ESW) System and NormalHeat Sink").

APPLICABILITY In MODES 1, 2, and 3, the HPSW System is required to beOPERABLE to support the OPERABILITY of the RHR System forprimary containment cooling (LCO 3.6.2.3, "Residual HeatRemoval (RHR) Suppression Pool Cooling," and LCO 3.6.2.4,"Residual Heat Removal (RHR) Suppression Pool Spray") anddecay heat removal (LCO 3.4.7, "Residual Heat Removal (RHR)Shutdown Cooling System-Hot Shutdown"). The Applicabilityis therefore consistent with the requirements of thesesystems.

In MODES 4 and 5, the OPERABILITY requirements of the HPSWSystem are determined by the systems it supports, andtherefore, the requirements are not the same for all facetsof operation in MODES 4 and 5. Thus, the LCOs of the RHRshutdown cooling system, which requires portions of the HPSWSystem to be OPERABLE, will govern HPSW System operation inMODES 4 and 5.

ACTIONS A.__

With one HPSW subsystem inoperable, the inoperable HPSWsubsystem must be restored to OPERABLE status within 7 days.With the unit in this condition, the remaining OPERABLE HPSWsubsystem is adequate to perform the HPSW heat removalfunction. However, the overall reliability is reducedbecause a single failure in the OPERABLE HPSW subsystem

(continued)


HPSW SystemB 3.7.1

BASES


could result in loss of HPSW function. The Completion Timeis based on the redundant HPSW capabilities afforded by theOPERABLE subsystem and the low probability of an eventoccurring requiring HPSW during this period.

The Required Action is modified by a Note indicating thatthe applicable Conditions of LCO 3.4.7, be entered andRequired Actions taken if an inoperable HPSW subsystemresults in an inoperable RHR shutdown cooling subsystem.This is an exception to LCO 3.0.6 and ensures the properactions are taken for these components.

B._1

With both HPSW subsystems inoperable, the HPSW System is notcapable of performing its intended function. At least onesubsystem must be restored to OPERABLE status within8 hours. The 8 hour Completion Time for restoring one HPSWsubsystem to OPERABLE status, is based on the CompletionTimes provided for the RHR suppression pool cooling andspray functions.

The Required Action is modified by a Note indicating thatthe applicable Conditions of LCO 3.4.7, be entered andRequired Actions taken if an inoperable HPSW subsystemresults in an inoperable RHR shutdown cooling subsystem.This is an exception to LCO 3.0.6 and ensures the properactions are taken for these components.

C.1 and C.2

If the HPSW subsystems cannot be restored to OPERABLE statuswithin the associated Completion Times, the unit must beplaced in a MODE in which the LCO does not apply. Toachieve this status, the unit must be placed in at leastMODE 3 within 12 hours and in MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from fullpower conditions in an orderly manner and withoutchallenging unit systems.

(continued)


HPSW SystemB 3.7.1

BASES (continued)


Verifying the correct alignment for each manual and poweroperated valve in each HPSW subsystem flow path providesassurance that the proper flow paths will exist for HPSWoperation. This SR does not apply to valves that arelocked, sealed, or otherwise secured in position, sincethese valves are verified to be in the correct positionprior to locking, sealing, or securing. A valve is alsoallowed to be in the nonaccident position, and yetconsidered in the correct position, provided it can berealigned to its accident position. This is acceptablebecause the HPSW System is a manually initiated system.

This SR does not require any testing or valve manipulation;rather, it involves verification that those valves capableof being mispositioned are in the correct position. This SRdoes not apply to valves that cannot be inadvertentlymisaligned, such as check valves.

The 31 day Frequency is based on engineering judgment, isconsistent with the procedural controls governing valveoperation, and ensures correct valve positions.



3. NEDC-32183P, "Power Rerate Safety Analysis Report ForPeach Bottom 2 & 3," May 1993.



ESW System and Norma 1 Heat SinkB 3.7.2

B 3.7 PLANT SYSTEMS

B 3.7.2 Emergency Service Water (ESW) System and Normal Heat Sink

BASES

BACKGROUND The ESW System is a standby system which is shared betweenUnits 2 and 3. It is designed to provide cooling water forthe removal of heat from equipment, such as the dieselgenerators (DGs) and room coolers for Emergency Core CoolingSystem equipment, required for a safe reactor shutdownfollowing a Design Basis Accident (DBA) or transient. Uponreceipt of a loss of offsite power signal, or whenever anydiesel generator is in operation, the ESW System willprovide cooling water to its required loads.

The ESW System consists of two redundant subsystems. Eachof the two ESW subsystems consist of a 100% capacity8000 gpm pump, a suction source, valves, piping andassociated instrumentation. Either of the two subsystems iscapable of providing the required cooling capacity tosupport the required systems for both units. Each subsystemprovides coolant in separate piping to common headers; oneeach for the DG coolers, Unit 2 safeguard equipment coolers,and Unit 3 safeguard equipment coolers. The design is suchthat any single active failure will not affect the ESWSystem from providing coolant to the required loads.

Cooling water is pumped from the normal heat sink (ConowingoPond) via the pump structure bay by the ESW pumps to theessential components. After removing heat from thecomponents, the water is discharged to the discharge pond,or the emergency cooling tower in certain test alignments.An alternate suction supply and discharge path (from theemergency heat sink) is available in the unlikely event theConowingo dam fails or the pond floods. This lineup,however, has to be manually aligned.


Sufficient water inventory is available for all ESW Systempost LOCA cooling requirements for a 30 day period with noadditional makeup water source available. The ability ofthe ESW System to support long term cooling of the reactorcontainment is assumed in evaluations of the equipmentrequired for safe reactor shutdown presented in the UFSAR,Chapter 14 (Ref. 1). These analyses include the evaluationof the long term primary containment response after a designbasis LOCA.

(continued)


ESW System and Normal Heat SinkB 3.7.2

BASES


(continued)

The ability of the ESW System to provide adequate cooling tothe identified safety equipment is an implicit assumptionfor the safety analyses evaluated in Reference 1. Theability to provide onsite emergency AC power is dependent onthe ability of the ESW System to cool the DGs. The longterm cooling capability of the RHR and core spray pumps isalso dependent on the cooling provided by the ESW System.

ESW provides cooling to the HPCI and RCIC room coolers;.however, cooling function is not required to support HPCI orRCIC System operability.

The ESW System, together with the Normal Heat Sink, satisfyCriterion 3 of the NRC Policy Statement.

LCO The ESW subsystems are independent to the degree that eachESW pump has separate controls, power supplies, and theoperation of one does not depend on the other. In the eventof a DBA, one subsystem of ESW is required to provide theminimum heat removal capability assumed in the safetyanalysis for the system to which it supplies cooling water.To ensure this requirement is met, two subsystems of ESWmust be OPERABLE. At least one subsystem will operate, ifthe worst single active failure occurs coincident with theloss of offsite power.

A subsystem is considered OPERABLE when it has an OPERABLEnormal heat sink, one OPERABLE pump, and an OPERABLE flowpath capable of taking suction from the pump structure andtransferring the water to the appropriate equipment.

The OPERABILITY of the normal heatminimum and maximum water level inConowingo Datum (CD) and 113 ft CDmaximum water temperature of 90°F.

sink is based on having athe pump bay of 98.5 ftrespectively and a

The isolation of the ESW System to components or systems mayrender those components or systems inoperable, but does notaffect the OPERABILITY of the ESW System.

APPLICABILITY In MODES 1, 2, and 3, the ESW System and normal heat sinkare required to be OPERABLE to support OPERABILITY of theequipment serviced by the ESW System. Therefore, theESW System and normal heat sink are required to be OPERABLEin these MODES.

(continued)



BASES

APPLICABILITY In MODES 4 and 5, the OPERABILITY requirements of the ESW(continued) System and normal heat sink are determined by the systems

they support, and therefore the requirements are not thesame for all facets of operation in MODES 4 and 5. Thus,the LCOs of the systems supported by the ESW System andnormal heat sink will govern ESW System and normal heat sinkOPERABILITY requirements in MODES 4 and 5.

ACTIONS A.1

With one ESW subsystem inoperable, the ESW subsystem must berestored to OPERABLE status within 7 days. With the unit inthis condition, the remaining OPERABLE ESW subsystem isadequate to perform the heat removal function. However, theoverall reliability is reduced because a single failure inthe OPERABLE ESW subsystem could result in loss of ESWfunction.

The 7 day Completion Time is based on the redundant ESWSystem capabilities afforded by the OPERABLE subsystem, thelow probability of an event occurring during this timeperiod, and is consistent with the allowed Completion Timefor restoring an inoperable DG.

B.1

With water temperature of the normal heat sink > 90°F and• 92 0 F, the design basis assumptions associated with theinitial normal heat sink temperature are bounded providedthe temperature of the normal heat sink when averaged overthe previous 24 hour period is • 90 0 F. To ensure that the92 0 F normal heat sink temperature limit is not exceeded,Required Action B.1 is provided to more frequently monitorthe temperature of the normal heat sink. The Unit 2 normalheat sink temperature is measured from the Unit 2 intakecanal. The once per hour completion time takes intoconsideration normal heat sink temperature variations andthe increased monitoring frequency needed to ensure designbasis assumptions and equipment limitations are notexceeded in this condition. If the water temperature ofthe normal heat sink exceeds 90°F when averaged over theprevious 24 hour period or the water temperature of thenormal heat sink exceeds 92 0 F, Condition C must be enteredimmediately.

(continued)



BASES


If the ESW System cannot be restored to OPERABLE statuswithin the associated Completion Time, or both ESWsubsystems are inoperable, or the normal heat sink isinoperable, the unit must be placed in a MODE in which theLCO does not apply. To achieve this status, the unit mustbe placed in at least MODE 3 within 12 hours and in MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired unit conditions from full power conditions in anorderly manner and without challenging unit systems.


This SR verifies the water level in the pump bay of the pumpstructure to be sufficient for the proper operation of theESW pumps (the pump's ability to meet the minimum flow rateand anticipatory actions required for flood conditions are

(continued)



BASES


considered in determining these limits). The 24 hourFrequency is based on operating experience related totrending of the parameter variations during the applicableMODES.

SR 3.7.2.2

Verification of the normal heat sink temperature ensuresthat the heat removal capability of the ESW and HPSW systemsis within the DBA analysis. The Unit 2 normal heat sinktemperature is measured from the Unit 2 intake canal. The 24hour Frequency is based on operating experience related totrending of the parameter variations during the applicableMODES.

SR 3.7.2.3

Verifying the correct alignment for each manual and poweroperated valve in each ESW subsystem flow path providesassurance that the proper flow paths will exist for ESWoperation. This SR does not apply to valves that arelocked, sealed, or otherwise secured in position, sincethese valves were verified to be in the correct positionprior to locking, sealing, or securing. A valve is alsoallowed to be in the nonaccident position, and yetconsidered in the correct position, provided it can beautomatically realigned to its accident position within therequired time. This SR does not require any testing orvalve manipulation; rather, it involves verification thatthose valves capable of being mispositioned are in thecorrect position. This SR does not apply to valves thatcannot be inadvertently misaligned, such as check valves.

This SR is modified by a Note indicating that isolation ofthe ESW System to components or systems may render thosecomponents or systems inoperable, but does not affect theOPERABILITY of the ESW System. As such, when all ESW pumps,valves, and piping are OPERABLE, but a branch connection offthe main header is isolated, the ESW System is stillOPERABLE.

The 31 day Frequency is based on engineering judgment, isconsistent with the procedural controls governing valveoperation, and ensures correct valve positions.

(continued)



BASES


(continued)

SR 3.7.2.4

This SR verifies that the ESW System pumps willautomatically start to provide cooling water to the requiredsafety related equipment during an accident event. This isdemonstrated by the use of an actual or simulated initiationsignal.

Operating experience has shown that these components willusually pass the SR when performed at the 24 monthFrequency. Therefore, this Frequency is concluded to beacceptable from a reliability standpoint.



Emergency Heat SinkB 3.7.3

B 3.7 PLANT SYSTEMS

B 3.7.3 Emergency Heat Sink

BASES

BACKGROUND The function of the emergency heat sink is to provide heatremoval capability so that the Unit 2 and 3 reactors can besafely shutdown in the event of the unavailability of thenormal heat sink (Conowingo Pond). The emergency heat sinksupports the dissipation of sensible and decay heat so thatthe two reactors can be shutdown when the normal heat sinkis unavailable due to flooding or failure of the Conowingodam. This function is provided via the Emergency ServiceWater (ESW) System and the High Pressure Service WaterSystem (HPSW).

The emergency heat sink consists of an induced draft threecell cooling tower with an integral storage reservoir, threeemergency cooling tower fans, two ESW booster pumps, valves,piping, and associated instrumentation. The emergencycooling tower, equipment, valves, and piping of theemergency heat sink are designed in accordance with seismicClass I criteria. Standby power is provided to ensure theemergency heat sink is capable of operating during a loss ofoffsite power. W

When the normal heat sink (Conowingo Pond) is lost or whenflooding occurs, sluice gates in the pump structure housingthe ESW pumps and HPSW pumps are closed. Water is thenprovided through two gravity fed lines from the emergencyheat sink reservoir into the pump structure pump bays. TheESW and HPSW pumps then pump cooling water to heatexchangers required to bring the Unit 2 and 3 reactors tosafe shutdown conditions. Return water from the HPSW Systemflows directly to two of the three cells of the emergencycooling tower. Return water from the ESW System flowsthrough one of the two ESW booster pumps and is pumped intoone of the emergency cooling tower cells used by the HPSWSystem. This configuration allows for closed cycleoperation of the ESW and HPSW Systems.

Sufficient capacity (3.7 million gallons of water) isavailable, when the minimum water level is 17 feet above thebottom of the emergency heat sink reservoir, to supportsimultaneous shutdown of Units 2 and 3 for 7 days withoutmakeup water. After 7 days, makeup water will be providedfrom the Susquehanna River or from tank trucks.

(continued)



BASES (continued)


The emergency heat sink is required to support removal ofheat from the Unit 2 and 3 reactors, primary containments,and other safety related equipment by providing a seismicClass I heat sink for the ESW and HPSW Systems for shutdownof the reactors when the normal non-safety grade heat sink(Conowingo Pond) is unavailable. Sufficient water inventoryis available to supply all the ESW and HPSW System coolingrequirements of both units during shutdown with a concurrentloss of offsite power for a 7 day period with no additionalmakeup water available. The ability of the emergency heatsink to support the shutdown of both Units 2 and 3 in theevent of the loss of the normal heat sink is presented inthe UFSAR (Ref. 1).

The Emergency Heat Sink satisfies Criterion 3 of the NRCPolicy Statement.

LCO In the event the normal heat sink is unavailable and offsitepower is lost, the emergency heat sink is required toprovide the minimum heat removal capability for the ESW andHPSW Systems to safely shutdown both units. To ensure thisrequirement is met, the emergency heat sink must beOPERABLE.

The emergency heat sink is considered OPERABLE when it hasan OPERABLE flow path from the ESW System with one OPERABLEESW booster pump, an OPERABLE flow path from both the Unit 2and Unit 3 HPSW Systems, two of the three cooling towercells and two of the three associated fans OPERABLE, oneOPERABLE gravity feed line from the emergency heat sinkreservoir into the pump structure bays with the capabilityto connect the Unit 2 and 3 pump structure bays, or oneOPERABLE gravity feed line from the emergency heat sink tothe Unit 2 pump structure bay with the Unit 2 and Unit 3bays not connected, and the capability exists to manuallyisolate the ESW and HPSW pump structure bays from theConowingo Pond. Valves in the required flow paths areconsidered OPERABLE if they can be manually aligned to theircorrect position. The OPERABILITY of the emergency heatsink also requires a minimum water level in the emergencyheat sink reservoir of 17 feet.

(continued)



BASES

LCO(continued)

Emergency heat sink water temperature is not addressed inthis LCO since the maximum water temperature of theemergency cooling tower reservoir has been demonstrated,based on historical data, to be bounded by the normal heatsi.nk requirements (LCO 3.7.2, "Emergency Service Water (ESW)System and Normal Heat Sink").

APPLICABILITY In MODES 1, 2, and 3, the emergency heat sink is required tobe OPERABLE to provide a seismic Class I source of coolingwater to the ESW and HPSW Systems when the normal heat sinkis unavailable. Therefore, the emergency heat sink isrequired to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of theemergency heat sink are determined by the systems itsupports in the event the normal heat sink is unavailable.

ACTIONS A.1

With one required emergency cooling tower fan inoperable,action must be taken to restore the required emergencycooling tower fan to OPERABLE status within 14 days. The 14day Completion Time is based on the remaining heat removalcapability, the low probability of an event occurringrequiring the inoperable emergency cooing tower fan tofunction, and the capability of the remaining emergencycooling tower fan.

B.1

With the emergency heat sink inoperable for reasons otherthan Condition A, the emergency heat sink must be restoredto OPERABLE status within 7 days. With the unit in thiscondition, the normal heat sink (Conowingo Pond) is adequateto perform the heat removal function; however, the overallreliability is reduced. The 7 day Completion Time is basedon the remaining heat removal capability and the lowprobability of an event occurring requiring the emergencyheat sink to be OPERABLE during this time period.

(continued)



BASES


If the emergency heat sink cannot be restored to OPERABLEstatus within the associated Completion Time, the unit mustbe placed in a MODE in which the LCO does not apply. Toachieve this status, the unit must be placed in at leastMODE 3 within 12 hours and in MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from fullpower conditions in an orderly manner and withoutchallenging unit systems.


This SR ensures adequate long term (7 days) cooling can bemaintained in the event of flooding or loss of the ConowingoPond. With the emergency heat sink water source below theminimum level, the emergency heat sink must be declaredinoperable. The 31 day Frequency is based on operatingexperience related to trending of the parameter variationsduring the applicable MODES.

SR 3.7.3.2

Operating each required emergency cooling tower fan forý 15 minutes ensures that all required fans are OPERABLE andthat all associated controls are functioning properly. Italso ensures that fan or motor failure, or excessivevibration, can be detected for corrective action. The92 day Frequency is based on operating experience, the knownreliability of the fan units, and the low probability ofsignificant degradation of the required emergency coolingtower fans occurring between surveillances.



MCREV System

B 3.7.4

B 3.7 PLANT SYSTEMS

B 3.7.4 Main Control Room Emergency Ventilation (MCREV) System

BASES

BACKGROUND The MCREV System limits the maximum temperature of the MainControl Room and provides a radiologically controlledenvironment from which the unit can be safely operatedfollowing a Design Basis Accident (DBA).

The safety related function of MCREV System includes twoindependent and redundant high efficiency air filtrationsubsystems and two 100% capacity emergency ventilationsupply fans which supply and provide emergency treatment ofoutside supply air. Each filtration subsystem consists of ahigh efficiency particulate air (HEPA) filter, an activatedcharcoal adsorber section, a second HEPA filter, and theassociated ductwork and dampers. Either emergencyventilation supply fan can operate in conjunction witheither filtration subsystem. Each filtration subsystemreceives outside air through the normal ventilationprefilter and air handling unit. Prefilters and HEPAfilters remove particulate matter, which may be radioactive.The charcoal adsorbers provide a holdup period for gaseousiodine, allowing time for decay. A dry gas purge isprovided to each MCREV subsystem during idle periods toprevent moisture accumulation in the filters.

The MCREV System is a standby system that is common to bothUnit 2 and Unit 3. The two MCREV subsystems must beOPERABLE if conditions requiring MCREV System OPERABILITYexist in either Unit 2 or Unit 3. Upon receipt of theinitiation signal(s) (indicative of conditions that couldresult in radiation exposure to control room personnel), theMCREV System automatically starts and pressurizes thecontrol room to prevent infiltration of contaminated airinto the control room. A system of dampers isolates thecontrol room, and outside air, taken in at the normalventilation intake, is passed through one of the charcoaladsorber filter subsystems for removal of airborneradioactive particles. During normal control roomventilation system restoration following operation of theMCREV system, the automatic initiation function of MCREVwill briefly be satisfied by operator actions and controlledprocedural steps.

The MCREV System is designed to limit the maximum spacetemperature of the Control Room to 114°F dry-bulb withventilation flow, but without air conditioning during a lossof offsite power (LOOP). If all normal ventilation and air

.conditioning were lost, the control room operator would

(continued)


MCREV SystemB 3.7.4

BASES


initiate an emergency shutdown of non-essential equipmentand lighting to reduce the heat generation to a minimum.Heat removal would be accomplished by conduction through thefloors, ceilings, and walls to adjacent rooms and to theenvironment. Additionally, the MCREV System is designed tomaintain the control room environment for a 30 daycontinuous occupancy after a DBA without exceeding 5 remwhole body dose. A single MCREV subsystem will pressurizethe control room to prevent infiltration of air fromsurrounding buildings. MCREV System operation inmaintaining control room habitability is discussed in theUFSAR, Chapters 7, 10, and 12, (Refs. 1, 2, and 3,respectively).


The ability of the MCREV System to maintain thehabitability of the control room is an explicit assumptionfor the safety analyses presented in the UFSAR, Chapters 10and 12 (Refs. 2 and 3, respectively). The MCREV System isassumed to operate following a loss of coolant accident,fuel handling accident, main steam line break, and controlrod drop accident, as discussed in the UFSAR,Section 14.9.1.5 (Ref. 4). The radiological doses tocontrol room personnel as a result of the various DBAs aresummarized in Reference 4. No single active or passivefailure will cause the loss of outside or recirculated airfrom the control room.

The MCREV System-satisfies Criterion 3 of the NRC PolicyStatement.

LCO Two redundant subsystems of the MCREV System are required tobe OPERABLE to ensure that at least one is available,assuming a single failure disables the other subsystem.Total system failure could result in exceeding a dose of5 rem to the control room operators in the event of a DBA.

The MCREV System is considered OPERABLE when the individualcomponents necessary to control operator exposure areOPERABLE in both subsystems. A subsystem is consideredOPERABLE when its associated:

a. Fan is OPERABLE;

(continued)


MCREV System

B 3.7.4

BASES

LCO b. HEPA filter and charcoal adsorbers are not excessively(continued) restricting flow and are capable of performing their

filtration functions; and

c. Ductwork, valves, and dampers are OPERABLE, and airflow can be maintained.

In addition, the control room boundary must be maintained,including the integrity of the walls, floors, ceilings, andductwork. Temporary seals may be used to maintain theboundary. In addition, an access door may be openedprovided the ability to pressurize the control room ismaintained and the capability exists to close the affecteddoor in an expeditious manner.

APPLICABILITY In MODES 1, 2, and 3, the MCREV System must be OPERABLE tocontrol operator exposure during and following a DBA, sincethe DBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a DBAare reduced because of the pressure and temperaturelimitations in these MODES. Therefore, maintaining theMCREV System OPERABLE is not required in MODE 4 or 5, exceptfor the following situations under which significantradioactive releases can be postulated:

a. During operations with potential for draining thereactor vessel (OPDRVs);

b. During CORE ALTERATIONS; and

c. During movement of irradiated fuel assemblies in thesecondary containment.

ACTIONS A.1

With one MCREV subsystem inoperable, the inoperable MCREVsubsystem must be restored to OPERABLE status within 7 days.With the unit in this condition, the remaining OPERABLEMCREV subsystem is adequate to maintain control roomtemperature and to perform control room radiationprotection. However, the overall reliability is reducedbecause a single failure in the OPERABLE subsystem could

(continued)


MCREV SystemB 3.7.4

BASES


result in reduced MCREV System capability. The 7 dayCompletion Time is based on the low probability of a DBAoccurring during this time period, and that the remainingsubsystem can provide the required capabilities.

B.1 and B.2

In MODE 1, 2, or 3, if the inoperable MCREV subsystem cannotbe restored to OPERABLE status within the associatedCompletion Time, the unit must be placed in a MODE thatminimizes risk. To achieve this status, the unit must beplaced in at least MODE 3 within 12 hours and in MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired unit conditions from full power conditions in anorderly manner and without challenging unit systems.

C.1, C.2.1. C.2.2. and C.2.3

The Required Actions of Condition C are modified by a Noteindicating that LCO 3.0.3 does not apply. If movingirradiated fuel assemblies while in MODE 1, 2, or 3, thefuel movement is independent of reactor operations.Therefore, inability to suspend movement of irradiated fuelassemblies is not sufficient reason to require a reactorshutdown.

During movement of irradiated fuel assemblies in thesecondary containment, during CORE ALTERATIONS, or duringOPDRVs, if the inoperable MCREV subsystem cannot be restoredto OPERABLE status within the required Completion Time, theOPERABLE MCREV subsystem may be placed in operation. Thisaction ensures that the remaining subsystem is OPERABLE,that no failures that would prevent automatic actuation willoccur, and that any active failure will be readily detected.

An alternative to Required Action C.1 is to immediatelysuspend activities that present a potential for releasingradioactivity that might require isolation of the controlroom. This places the unit in a condition that minimizesrisk.

(continued)


MCREV SystemB 3.7.4

BASES

ACTIONS C.1, C.2.1, C.2.2, and C.2.3 (continued)

If applicable, CORE ALTERATIONS and movement of irradiatedfuel assemblies in the secondary containment must besuspended immediately. Suspension of these activities shallnot preclude completion of movement of a component to a safeposition. Also, if applicable, actions must be initiatedimmediately to suspend OPDRVs to minimize the probability ofa vessel draindown and the subsequent potential for fissionproduct release. Actions must continue until the OPDRVs aresuspended.

D._1

If both MCREV subsystems are inoperable in MODE 1, 2, or 3,the MCREV System may not be capable of performingthe intended function and the unit is in a condition outsidethe accident analyses. Therefore, LCO 3.0.3 must be enteredimmediately.

E.I. E.2. and E.3

The Required Actions of Condition E are modified by a Noteindicating that LCO 3.0.3 does not apply. If movingirradiated fuel assemblies while in MODE 1, 2, or 3, thefuel movement is independent of reactor operations.Therefore, inability to suspend movement of irradiated fuelassemblies is not sufficient reason to require a reactorshutdown.

During movement of irradiated fuel assemblies in thesecondary containment, during CORE ALTERATIONS, or duringOPDRVs, with two MCREV subsystems inoperable, action must betaken immediately to suspend activities that present apotential for releasing radioactivity that might requireisolation of the control room. This places the unit in acondition that minimizes risk.

If applicable, CORE ALTERATIONS and movement of irradiatedfuel assemblies in the secondary containment must besuspended immediately. Suspension of these activities shallnot preclude completion of movement of a component to a safeposition. If applicable, actions must be initiated

(continued)


MCREV SystemB 3.7.4

BASES

ACTIONS E.1, E.2, and E.3 (continued)

immediately to suspend OPDRVs to minimize the probability ofa vessel draindown and subsequent potential for fissionproduct release. Actions must continue until the OPDRVs aresuspended.


This SR verifies that a subsystem in a standby mode startson demand and continues to operate for 2 15 minutes.Standby systems should be checked periodically to ensurethat they start and function properly. As the environmentaland normal operating conditions of this system are notsevere, testing each subsystem once every month provides anadequate check on this system. Furthermore, the 31 dayFrequency is based on the known reliability of the equipmentand the two subsystem redundancy available.

SR 3.7.4.2

This SR verifies that the required MCREV testing isperformed in accordance with the Ventilation Filter TestingProgram (VFTP). The VFTP includes testing HEPA filterperformance, charcoal adsorber efficiency, minimum systemflow rate, and the physical properties of the activatedcharcoal (general use and following specific operations).Specific test frequencies and additional information arediscussed in detail in the VFTP.

SR 3.7.4.3

This SR verifies that on an actual or simulated initiationsignal, each MCREV subsystem starts and operates. The LOGICSYSTEM FUNCTIONAL TEST in SR 3.3.7.1.4 overlaps this SR toprovide complete testing of the safety function. Operatingexperience has shown that these components will usually passthe SR when performed at the 24 month Frequency. Therefore,this Frequency is concluded to be acceptable from areliability standpoint.

(continued)


MCREV SystemB 3.7.4

BASES


(continued)

SR 3.7.4.4

This SR verifies the integrity of the control roomenclosure, and the assumed inleakage rates of potentiallycontaminated air. The control room positive pressure, withrespect to potentially contaminated adjacent areas (theturbine building), is periodically tested to verify properfunction of the MCREV System. During operation, the MCREVSystem is designed to slightly pressurize the control room> 0.1 inches water gauge positive pressure with respect tothe turbine building to prevent unfiltered inleakage. TheMCREV System is designed to provide this positive pressureat a flow rate of > 2700 cfm and < 3300 cfm to the controlroom when in operation. Manual adjustment of the MCREVSystem may be required to establish the flow rate of ! 2700cfm and < 3300 cfm during SR performance. The Frequency of24 months on a STAGGERED TEST BASIS is consistent with otherfiltration systems SRs.






Main Condenser OffgasB 3.7.5

B 3.7 PLANT SYSTEMS

B 3.7.5 Main Condenser Offgas

BASES

BACKGROUND During unit operation, steam from the low pressure turbineis exhausted directly into the condenser. Air andnoncondensible gases are collected in the condenser, thenexhausted through the steam jet air ejectors (SJAEs) to theMain Condenser Offgas System. The offgas from the maincondenser normally includes radioactive gases.

The Main Condenser Offgas System has been incorporated intothe unit design to reduce the gaseous radwaste emission.This system uses a catalytic recombiner to recombineradiolytically dissociated hydrogen and oxygen. The gaseousmixture is cooled and water vapor removed by the offgasrecombiner condenser; the remaining water and condensiblesare stripped out by the cooler condenser and moistureseparator. The remaining gaseous mixture (i.e., the offgasrecombiner effluent) is then processed by a charcoaladsorber bed prior to release.


The main condenser offgas gross gamma activity rate is aninitial condition of the Main Condenser Offgas Systemfailure event, discussed in the UFSAR, Section 9.4.5(Ref. 1). The analysis assumes a gross failure in the MainCondenser Offgas System that results in the rupture of theMain Condenser Offgas System pressure boundary. The grossgamma activity rate is controlled to ensure that, during theevent, the calculated offsite doses will be well within thelimits of 10 CFR 100 (Ref. 2) or the NRC staff approvedlicensing basis.

The main condenser offgas limits satisfy Criterion 2 of theNRC Policy Statement.

LCO To ensure compliance with the assumptions of the MainCondenser Offgas System failure event (Ref. 1), the fissionproduct release rate should be consistent with a noble gasrelease to the reactor coolant of 100 pCi/MWt-second afterdecay of 30 minutes. The LCO is established consistent

(continued)



BASES

LCO(continued)

with this requirement (3293 MWt x 100 pCi/MWt-second =320,000, pCi/second) and is based on the original licensedrated thermal power.

APPLICABILITY The LCO is applicable when steam is being exhausted to themain condenser and the resulting noncondensibles are beingprocessed via the Main Condenser Offgas System. This occursduring MODE 1, and during MODES 2 and 3 with any main steamline not isolated and the SJAE in operation. In MODES 4and 5, steam is not being exhausted to the main condenserand the requirements are not applicable.

ACTIONS A.I

If the offgas radioactivity rate limit is exceeded, 72 hoursis allowed to restore the gross gamma activity rate towithin the limit. The 72 hour Completion Time isreasonable, based on engineering judgment, the time requiredto complete the Required Action, the large marginsassociated with permissible dose and exposure limits, andthe low probability of a Main Condenser Offgas Systemrupture.

B.I. B.2. B.3.1. and B.3.2

If the gross gamma activity rate is not restored to withinthe limits in the associated Completion Time, all main steamlines or the SJAE must be isolated. This isolates the MainCondenser Offgas System from the source of the radioactivesteam. The main steam lines are considered isolated if atleast one main steam isolation valve in each main steam lineis closed, and at least one main steam line drain valve ineach drain line inboard of the main steam isolation valvesis closed. The 12 hour Completion Time is reasonable, basedon operating experience, to perform the actions from fullpower conditions in an orderly manner and withoutchallenging unit systems.

An alternative to Required Actions B.1 and B.2 is to placethe unit in a MODE in which the LCO does not apply. Toachieve this status, the unit must be placed in at leastMODE 3 within 12 hours and in MODE 4 within 36 hours. Theallowed Completion Times are reasonable, based on operating

(continued)



BASES

ACTIONS B.I. B.2. B.3.1. and B.3.2 (continued)

experience, to reach the required unit conditions from fullpower conditions in an orderly manner and withoutchallenging unit systems.


This SR, on a 31 day Frequency, requires an isotopicanalysis of an offgas sample to ensure that the requiredlimits are satisfied. The noble gases to be sampled areXe-133, Xe-135, Xe-138, Kr-85m, Kr-87, and Kr-88. If themeasured rate of radioactivity increases significantly (byý 50% after correcting for expected increases due to changesin THERMAL POWER), an isotopic analysis is also performedwithin 4 hours after the increase is noted, to ensure thatthe increase is not indicative of a sustained increase inthe radioactivity rate. The 31 day Frequency is adequate inview of other instrumentation that continuously monitor theoffgas, and is acceptable, based on operating experience.

This SR is modified by a Note indicating that the SR is notrequired to be performed until 31 days after any main steamline is not isolated and the SJAE is in operation. Only inthis condition can radioactive fission gases be in the MainCondenser Offgas System at significant rates.


2. 10 CFR 100.


Main Turbine Bypass SystemB 3.7.6

B 3.7 Plant SYSTEMS

B 3.7.6 Main Turbine Bypass System

BASES

BACKGROUND The Main Turbine Bypass System is designed to control steampressure when reactor steam generation exceeds turbinerequirements during unit startup, sudden load reduction, andcooldown. It allows excess steam flow from the reactor tothe condenser without going through the turbine. The bypasscapacity of the system is 25% of the Nuclear Steam SupplySystem rated steam flow. Sudden load reductions within thecapacity of the steam bypass can be accommodated withoutsafety relief valves opening or a reactor scram. The MainTurbine Bypass System consists of nine modulating typehydraulically actuated bypass valves mounted on a valvemanifold. The manifold is connected with two steam lines tothe four main steam lines upstream of the turbine stopvalves. The bypass valves are controlled by the bypasscontrol unit of the Pressure Regulator and Turbine GeneratorControl System, as discussed in the UFSAR, Section 7.11.3(Ref. 1). The bypass valves are normally closed. However,if the total steam flow signal exceeds the turbine controlvalve flow signal of the Pressure Regulator and TurbineGenerator Control System, the bypass control unit processesthese signals and will output a bypass flow signal to thebypass valves. The bypass valves will then opensequentially to bypass the excess flow through connectingpiping and a pressure reducing orifice to the condenser.


The Main Turbine Bypass System is expected to functionduring the electrical load rejection transient, the turbinetrip transient, and the feedwater controller failure maximumdemand transient, as described in the UFSAR,Section 14.5.1.1 (Ref. 2), Section 14.5.1.2.1 (Ref. 3), andSection 14.5.2.2 (Ref. 4). However, the feedwatercontroller maximum demand transient is the limitinglicensing basis transient which defines the MCPR operatinglimit if the Main Turbine Bypass System is inoperable.Opening the bypass valves during the pressurization eventsmitigates the increase in reactor vessel pressure, whichaffects the MCPR during the event.

The Main Turbine Bypass System satisfies Criterion 3 of theNRC Policy Statement.

(continued)



BASES (continued)

LCO The Main Turbine Bypass System is required to be OPERABLE tolimit peak pressure in the main steam lines and maintainreactor pressure within acceptable limits during events thatcause rapid pressurization, so that the Safety Limit MCPR isnot exceeded. With the Main Turbine Bypass Systeminoperable, modifications to the APLHGR operating limits(LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE(APLHGR)"), the MCPR operating limits (LCO 3.2.2, "MINIMUMCRITICAL POWER RATIO (MCPR)"), and the LHGR operating limits(LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)") may beapplied to allow this LCO to be met. The operating limitsfor the inoperable Main Turbine Bypass System are specifiedin the COLR. An OPERABLE Main Turbine Bypass Systemrequires the minimum number of bypass valves, specified inthe COLR, to open in response to increasing main steam linepressure. This response is within the assumptions of theapplicable analyses (Refs. 2, 3, and 4).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE atŽ 25% RTP to ensure that the fuel cladding integrity SafetyLimit and the cladding 1% plastic strain limit are notviolated during the applicable safety analyses transients.As discussed in the Bases for LCO 3.2.3, "LINEAR HEATGENERATION RATE (LHGR)," and LCO 3.2.2, sufficient margin tothese limits exists at < 25% RTP. Therefore, theserequirements are only necessary when operating at or abovethis power level.

ACTIONS A.1

If the Main Turbine Bypass System is inoperable (one or morerequired bypass valves as specified in the COLR inoperable),or the required thermal operating limits for an inoperableMain Turbine Bypass System, as specified in the COLR, arenot applied, the assumptions of the design basis transientanalyses may not be met. Under such circumstances, promptaction should be taken to restore the Main Turbine BypassSystem to OPERABLE status or adjust the thermal operatinglimits accordingly. The 2 hour Completion Time isreasonable, based on the time to complete the RequiredAction and the low probability of an event occurring duringthis period requiring the Main Turbine Bypass System.

(continued)



BASES


If the Main Turbine Bypass System cannot be restored toOPERABLE status or the required thermal operating limits foran inoperable Main Turbine Bypass System are not applied,THERMAL POWER must be reduced to < 25% RTP. As discussed inthe Applicability section, operation at < 25% RTP results insufficient margin to the required limits, and the MainTurbine Bypass System is not required to protect fuelintegrity during the applicable safety analyses transients.The 4 hour Completion Time is reasonable, based on operatingexperience, to reach the required unit conditions from fullpower conditions in an orderly manner without challengingunit systems.


Cycling each main turbine bypass valve through one completecycle of full travel demonstrates that the valves aremechanically OPERABLE and will function when required. The31 day Frequency is based on manufacturer's recommendations(Ref. 5), is consistent with the procedural controlsgoverning valve operation, and ensures correct valvepositions. Operating experience has shown that thesecomponents usually pass the SR when performed at the 31 dayFrequency. Therefore, the Frequency is acceptable from areliability standpoint.

SR 3.7.6.2

The Main Turbine Bypass System is required to actuateautomatically to perform its design function. This SRdemonstrates that, with the required system initiationsignals, the valves will actuate to their required position.The 24 month Frequency is based on the need to perform thisSurveillance under the conditions that apply during a unitoutage and because of the potential for an unplannedtransient if the Surveillance were performed with thereactor at power.

(continued)



BASES


(continued)

SR 3.7.6.3

This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIMEis in compliance with the assumptions of the appropriatesafety analyses. The response time limits are specified inCOLR. The 24 month Frequency is based on the need toperform this Surveillance under the conditions that applyduring a unit outage and because of the potential for anunplanned transient if the Surveillance were performed withthe reactor at power. Operating experience has shown the24 month Frequency, which is based on the refueling cycle,is acceptable from a reliability standpoint.





5. GE Service Information Letter No. 413, "Main SteamBypass Valve Testing," October 4, 1984.


Spent Fuel Storage Pool Water LevelB 3.7.7

B 3.7 PLANT SYSTEMS

B 3.7.7 Spent Fuel Storage Pool Water Level

BASES

BACKGROUND The minimum water level in the spent fuel storage pool meetsthe assumptions of iodine decontamination factors followinga fuel handling accident.

A general description of the spent fuel storage pool designis found in the UFSAR, Section 10.3 (Ref. 1). Theassumptions of the fuel handling accident are found in theUFSAR, Section 14.6.4 (Ref. 2).

APPLICABLE The water level above the irradiated fuel assemblies is anSAFETY ANALYSES implicit assumption of the fuel handling accident. A fuel

handling accident is evaluated to ensure that theradiological consequences (calculated whole body and thyroiddoses at the site boundary) are well below the guidelinesset forth in 10 CFR 100 (Ref. 3). A fuel handling accidentcould release a fraction of the fission product inventory bybreaching the fuel rod cladding as discussed in Reference 2.

The fuel handling accident is evaluated for the dropping ofan irradiated fuel assembly onto the reactor core. Theconsequences of a fuel handling accident over the spent fuelstorage pool are no more severe than those of the fuelhandling accident over the reactor core. The water level inthe spent fuel storage pool provides for absorption of watersoluble fission product gases and transport delays ofsoluble and insoluble gases that must pass through the waterbefore being released to the secondary containmentatmosphere. This absorption and transport delay reduces thepotential radioactivity of the release during a fuelhandling accident.

The spent fuel storage pool water level satisfies Criteria 2and 3 of the NRC Policy Statement.

LCO The specified water level (232 ft 3 inches plant elevation,which is equivalent to 22 ft over the top of irradiated fuelassemblies seated in the spent fuel storage pool racks)preserves the assumptions of the fuel handling accidentanalysis (Ref. 2). As such, it is the minimum required forfuel movement within the spent fuel storage pool.

(continued)


Spent Fuel Storage Pool Water LevelB 3.7.7

BASES (continued)

APPLICABILITY This LCO applies during movement of fuel assemblies in thespent fuel storage pool since the potential for a release offission products exists.

ACTIONS A._I

Required Action A.1 is modified by a Note indicating thatLCO 3.0.3 does not apply. If moving fuel assemblies whilein MODE 1, 2, or 3, the fuel movement is independent ofreactor operations. Therefore, inability to suspendmovement of fuel assemblies is not a sufficient reason torequire a reactor shutdown.

When the initial conditions for an accident cannot be met,action must be taken to preclude the accident fromoccurring. If the spent fuel storage pool level is lessthan required, the movement of fuel assemblies in the spentfuel storage pool is suspended immediately. Suspension ofthis activity shall not preclude completion of movement of afuel assembly to a safe position. This effectivelyprecludes a spent fuel handling accident from occurring.


This SR verifies that sufficient water is available in theevent of a fuel handling accident. The water level in thespent fuel storage pool must be checked periodically. The7 day Frequency is acceptable, based on operatingexperience, considering that the water volume in the pool isnormally stable, and all water level changes are controlledby unit procedures.

REFERENCES I. UFSAR, Section 10.3.


3. 10 CFR 100.


AC Sources-OperatingB 3.8.1


B 3.8.1 AC Sources--Operating

BASES

BACKGROUND The unit AC sources for the Class 1E AC Electrical PowerDistribution System consist of the offsite power sources,and the onsite standby power sources (dieselgenerators (DGs)). As required by UFSAR Sections 1.5 and8.4.2 (Ref. 1), the design of the AC electrical power systemprovides independence and redundancy to ensure an availablesource of power to the Engineered Safety Feature (ESF)systems.

The Class IE AC distribution system is divided intoredundant load groups, so loss of any one group does notprevent the minimum safety functions from being performed.Each load group has connections to two qualified circuitsthat connect the unit to multiple offsite power supplies anda single DG.

The two qualified circuits between the offsite transmissionnetwork and the onsite Class 1E AC Electrical PowerDistribution System are supported by multiple, independentoffsite power sources. One of these qualified circuits canbe connected to either of two offsite sources: thepreferred offsite source is the 230 kV Nottingham-Gracetonline which supplies the plant through the 230/13.8 kVstartup and emergency auxiliary transformer no. 2; thealternate offsite source is the auto-transformer(500/230 kV) at North Substation which feeds a 230/13.8 kVregulating transformer (startup and emergency auxiliarytransformer no. 3), the 3SU regulating transformerswitchgear, and the 2SUA switchgear. The aligned source isfurther stepped down via the 2SU startup transformerswitchgear through the 13.2/4.16 kV emergency auxiliarytransformer no. 2. The other qualified circuit can beconnected to either of two offsite sources: the preferredoffsite source is the 230 kV Peach Bottom-Newlinville linewhich supplies a 230/13.8 kV transformer (startuptransformer no. 343); the alternate offsite source is theauto-transformer (500/230 kV) at North Substation whichfeeds a 230/13.8 kV regulating transformer (startup andemergency auxiliary transformer no. 3) and the 3SUregulating transformer switchgear. The aligned source isfurther stepped down via the 343SU transformer switchgear

(continued)


AC Sources -OperatingB 3.8.1

BASES

BACKGROUND through the 13.2/4.16 kV emergency auxiliary transformer(continued) no. 3. In addition, the alternate source can only be used

to meet the requirements of one offsite circuit. A detaileddescription of the offsite power network and circuits to theonsite Class IE ESF buses is found in the UFSAR,Sections 8.3 and 8.4 (Ref. 2).

A qualified offsite circuit consists of all breakers,transformers, switches, interrupting devices, cabling, andcontrols required to transmit power from the offsitetransmission network to the onsite Class IE emergency bus orbuses. The determination of the operability of a qualifiedsource of offsite power can be made using three factors,that when taken together, describe the design basiscalculation requirements for voltage regulation. Thecombination of these factors ensures that the offsitesource(s), which provide power to the plant emergency buses,will be fully capable of supporting the equipment requiredto achieve and maintain safe shutdown during postulatedaccidents and transients.

a) An offsite source of electrical power is consideredoperable if it is within the bounds of analyzedconditions. The most limiting analysis provides thefollowing bounds:

i) The Startup Transformer Load Tap Changer (LTC) isfunctional;

ii) Offsite source grid voltages are maintained above218.5 kV on the 230 kV system and 498 kV on the525 kV networks;

iii) Electrical buses and breaker alignments aremaintained within the bounds of approved plantprocedures.

b) Based on specific design analysis, variations to anyof these parameters is permissible, usually at thesacrifice of another parameter, based on plantconditions. Specifics regarding these variations arecontrolled by plant procedures or by conditionspecific design calculations.

A description of the Unit 3 offsite power sources isprovided in the Bases for Unit 3 LCO 3.8.1, "AC Sources-Operating." The description is identical with the exceptionthat the two offsite circuits provide power to the Unit 34 kV emergency buses (i.e., each Unit 2 offsite circuit iscommon to its respective Unit 3 offsite circuit except forthe 4 kV emergency bus feeder breakers).

(continued)



BASES


The onsite standby power source for the four 4 kV emergencybuses in each unit consists of four DGs. The four DGsprovide onsite standby power for both Unit 2 and Unit 3.Each DG provides standby power to two 4 kV emergency buses-one associated with Unit 2 and one associated with Unit 3.

A DG starts automatically on a loss of coolant accident(LOCA) signal (i.e., low reactor water level signal or highdrywell pressure signal) from either Unit 2 or Unit 3 or onan emergency bus degraded voltage or undervoltage signal.After the DG has started, it automatically ties to itsrespective bus after offsite power is tripped as aconsequence of emergency bus undervoltage or degradedvoltage, independent of or coincident with a LOCA signal.The DGs also start and operate in the standby mode withouttying to the emergency bus on a LOCA signal alone.Following the trip of offsite power, all loads are strippedfrom the emergency bus. When the DG is tied to theemergency bus, loads are then sequentially connected to itsrespective emergency bus by individual timers associatedwith each auto-connected load following a permissive from avoltage relay monitoring each emergency bus.

In the event of a loss of both offsite power sources, theESF electrical loads are automatically connected to the DGsin sufficient time to provide for safe reactor shutdown ofboth units and to mitigate the consequences of a DesignBasis Accident (DBA) such as a LOCA. Within 59 secondsafter the initiating signal is received, all automaticallyconnected loads needed to recover the unit or maintain it ina safe condition are returned to service. The failure ofany one DG does not impair safe shutdown because each DGserves an independent, redundant 4 kV emergency bus for eachunit. The remaining DGs and emergency buses have sufficientcapability to mitigate the consequences of a DBA, supportthe shutdown of the other unit, and maintain both units in asafe condition.

Ratings for the DGs satisfy the requirements of RegulatoryGuide 1.9 (Ref. 3) except that the loading of DG E2 mayexceed the 2000 hour rating during the first 10 minutes of aDBA LOCA. Each of the four DGs have the following ratings:

a. 2600 kW-continuous,

b. 3000 kW-2000 hours,

c. 3100 kW-200 hours,

d. 3250 kW-30 minutes.

(continued)



BASES (continued)


The initial conditions of DBA and transient analyses in theUFSAR, Chapter 14 (Ref. 4), assume ESF systems are OPERABLE.The AC electrical power sources are designed to providesufficient capacity, capability, redundancy, and reliabilityto ensure the availability of necessary power to ESF systemsso that the fuel, Reactor Coolant System (RCS), andcontainment design limits are not exceeded. These limitsare discussed in more detail in the Bases forSection 3.2, Power Distribution Limits; Section 3.5,Emergency Core Cooling Systems (ECCS) and Reactor CoreIsolation Cooling (RCIC) System; and Section 3.6,Containment Systems.

The OPERABILITY of the AC electrical power sources isconsistent with the initial assumptions of the accidentanalyses and is based upon meeting the design basis of theunit. This includes maintaining the onsite or offsite ACsources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite ACpower; and

b. A worst case single failure.

AC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO Two qualified circuits between the offsite transmissionnetwork and the onsite Class 1E Distribution System and fourseparate and independent DGs ensure availability of therequired power to shut down the reactor and maintain it in asafe shutdown condition after an abnormal operationaltransient or a postulated DBA. In addition, since someequipment required by Unit 2 is powered from Unit 3 sources(i.e., Standby Gas Treatment (SGT) System, emergency heatsink components, and Unit 3 125 VDC battery chargers),qualified circuit(s) between the offsite transmissionnetwork and the Unit 3 onsite Class 1E AC electrical powerdistribution subsystem(s) needed to support this equipmentmust also be OPERABLE.

An OPERABLE qualified Unit 2 offsite circuit consists of theincoming breaker and disconnect to the startup and emergencyauxiliary transformer, the respective circuit path to theemergency auxiliary transformer, and the circuit path to atleast three Unit 2 4 kV emergency buses including feeder

(continued)



BASES

LCO(continued)

breakers to the three Unit 2 4 kV emergency buses. If atleast one of the two circuits does not provide power or isnot capable of providing power to all four Unit 2 4 kVemergency buses, then the Unit 2 4 kV emergency buses thateach circuit powers or is capable of powering cannot all bethe same (i.e., two feeder breakers on one Unit 2 4 kVemergency bus cannot be inoperable). An OPERABLE qualifiedUnit 3 offsite circuit's requirements are the same as theUnit 2 circuit's requirements, except that the circuit path,including the feeder breakers, is to the Unit 3 4 kVemergency buses required to be OPERABLE by LCO 3.8.7,"Distribution Systems-Operating." Each offsite circuitmust be capable of maintaining rated frequency and voltage,and accepting required loads during an accident, whileconnected to the emergency buses.

Each DG has two ventilation supply fans; a main supply fanand a supplemental supply fan. The supplemental supply fanprovides additional air cooling to the generator area.Whenever outside air temperature is greater than or equal to80" F, each DG's main supply fan and supplemental supply fanare required to be OPERABLE for the associated DG to beOPERABLE. Whenever, outside air temperature is less than80* F, the supplemental supply fan is not required to beOPERABLE for the associated DG to be OPERABLE, however, themain supply fan is required to be OPERABLE for theassociated DG to be OPERABLE.

Each DG must be capable of starting, accelerating to ratedspeed and voltage, and connecting to its respective Unit 24 kV emergency bus on detection of bus undervoltage. Thissequence must be accomplished within 10 seconds. Each DGmust also be capable of accepting required loads within theassumed loading sequence intervals, and must continue tooperate until offsite power can be restored to the emergencybuses. These capabilities are required to be met from avariety of initial conditions, such as DG in standby withthe engine hot and DG in standby with the engine at ambientcondition. Additional DG capabilities must be demonstratedto meet required Surveillances, e.g., capability of the DGto revert to standby status on an ECCS signal whileoperating in parallel test mode. Proper sequencing ofloads, including tripping of all loads, is a requiredfunction for DG OPERABILITY.

(continued)

PBAPS UNIT 2 B 3.8-5 Revision 5


BASES

LCO(continued)

In addition, since some equipment required by Unit 2 ispowered from Unit 3 sources, the DG(s) capable of supplyingthe Unit 3 onsite Class 1E AC electrical power distributionsubsystem(s) needed to support this equipment must beOPERABLE. The OPERABILITY requirements for these DGs arethe same as described above, except that each required DGmust be capable of connecting to its respective Unit 3 4 kVemergency bus. (In addition, the Unit 3 ECCS initiationlogic SRs are not applicable, as described in SR 3.8.1.21Bases.)

The AC sources must be separate and independent (to theextent possible) of other AC sources. For the DGs, theseparation and independence are complete. For the offsiteAC sources, the separation and independence are to theextent practical. A circuit may be connected to more thanone 4 kV emergency bus division, with automatic transfercapability to the other circuit OPERABLE, and not violateseparation criteria. A circuit that is not connected to atleast three 4 kV emergency buses is required to haveOPERABLE automatic transfer interlock mechanisms such thatit can provide power to at least three 4 kV emergency busesto support OPERABILITY of that circuit.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2,and 3 to ensure that:

a. Acceptable fuel design limits and reactor coolantpressure boundary limits are not exceeded as a resultof abnormal operational transients; and

b. Adequate core cooling is provided and containmentOPERABILITY and other vital functions are maintainedin the event of a postulated DBA.

The AC power requirements for MODES 4 and 5 are covered inLCO 3.8.2, "AC Sources-Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to aninoperable DG. There is an increased risk associated withentering a MODE or other specified condition in theApplicability with an inoperable DG and the provisions of LCO3.0.4.b, which allow entry into a MODE or other specifiedcondition in the Applicability with the LCO not met afterperformance of a risk assessment addressing inoperablesystems and components, should not be applied in thiscircumstance.

A.1

To ensure a highly reliable power source remains with oneoffsite circuit inoperable, it is necessary to verify theavailability of the remaining offsite circuits on a morefrequent basis. Since the Required Action only specifies"perform," a failure of SR 3.8.1.1 acceptance criteria does

(continued)



BASES


not result in a Required Action not met. However, if asecond circuit fails SR 3.8.1.1, the second offsite circuitis inoperable, and Condition D, for two offsite circuitsinoperable, is entered.

A.2

Required Action A.2, which only applies if one 4 kVemergency bus cannot be powered from any offsite source, isintended to provide assurance that an event with acoincident single failure of the associated DG does notresult in a complete loss of safety function of criticalsystems. These features (e.g., system, subsystem, division,component, or device) are designed to be powered fromredundant safety related 4 kV emergency buses. Redundantrequired features failures consist of inoperable featuresassociated with an emergency bus redundant to the emergencybus that has no offsite power.

The Completion Time for Required Action A.2 is intended toallow time for the operator to evaluate and repair anydiscovered inoperabilities. This Completion Time alsoallows an exception to the normal "time zero" for beginningthe allowed outage time "clock." In this Required Actionthe Completion Time only begins on discovery that both:

a. A 4 kV emergency bus has no offsite power supplyingits loads; and

b. A redundant required feature on another 4 kV emergencybus is inoperable.

If, at any time during the existence of this Condition (oneoffsite circuit inoperable) a required feature subsequentlybecomes inoperable, this Completion Time would begin to betracked.

Discovering no offsite power to one 4 kV emergency bus ofthe onsite Class 1E Power Distribution System coincidentwith one or more inoperable required support or supportedfeatures, or both, that are associated with any otheremergency bus that has offsite power, results in startingthe Completion Times for the Required Action. Twenty-fourhours is acceptable because it minimizes risk while allowingtime for restoration before the unit is subjected totransients associated with shutdown.

(continued)



BASES

ACTIONS A._2 (continued)

The remaining OPERABLE offsite circuits and DGs are adequateto supply electrical power to the onsite Class IEDistribution System. Thus, on a component basis, singlefailure protection may have been lost for the requiredfeature's function; however, function is not lost. The24 hour Completion Time takes into account the componentOPERABILITY of the redundant counterpart to the inoperablerequired feature. Additionally, the 24 hour Completion Timetakes into account the capacity and capability of theremaining AC sources, a reasonable time for repairs, and thelow probability of a DBA occurring during this period.

A.3

The 4 kV emergency bus design and loading is sufficient toallow operation to continue in Condition A for a period notto exceed 7 days. With one offsite circuit inoperable, thereliability of the offsite system is degraded, and thepotential for a loss of offsite power is increased, withattendant potential for a challenge to the plant safetysystems. In this condition, however, the remaining OPERABLEoffsite circuits and the four DGs are adequate to supplyelectrical power to the onsite Class 1E Distribution System.

The 7 day Completion Time takes into account the redundancy,capacity, and capability of the remaining AC sources,reasonable time for repairs, and the low probability of aDBA occurring during this period.

The second Completion Time for Required Action A.3establishes a limit on the maximum time allowed for anycombination of required AC power sources to be inoperableduring any single contiguous occurrence of failing to meetLCO 3.8.1.a or b. If Condition A is entered while, forinstance, a DG is inoperable, and that DG is subsequentlyreturned OPERABLE, the LCO may already have been not met forup to 7 days. This situation could lead to a total of14 days, since initial failure to meet LCO 3.8.1.a or b, torestore the offsite circuit. At this time, a DG could againbecome inoperable, the circuit restored OPERABLE, and anadditional 7 days (for a total of 21 days) allowed prior tocomplete restoration of the LCO. The 14 day Completion Timeprovides a limit on the time allowed in a specifiedCondition after discovery of failure to meet LCO 3.8.1.a orb. This limit is considered reasonable for situations inwhich Conditions A and B are entered concurrently. The

(continuedl

PBAPS UNIT 2 B 3.8-8 l Revision 5

AC Sources--Operating

B 3.8.1

BASES

ACTIONS A3 (continued)

"AND" connector between the 7 day and 14 day CompletionTimes means that both Completion Times apply simultaneously,and the more restrictive Completion Time must be met.

As in Required Action A.2, the Completion Time allows for anexception to the normal "time zero" for beginning theallowed outage time "clock." This exception results inestablishing the "time zero" at the time the LCO wasinitially not met, instead of at the time that Condition Awas entered.

B.I

The 33 kV Conowingo Tie-Line, using a separate 33/13.8 kVtransformer, can be used to supply the circuit normallysupplied by startup and emergency auxiliary transformer no.2. While not a qualified circuit, this alternate source isa direct tie to the Conowingo Hydro Station that provides ahighly reliable source of power because: the line andtransformers at both ends of the line are dedicated to thesupport of PBAPS; the tie line is not subject to damage fromadverse weather conditions; and, the tie line can beisolated from other parts of the grid when necessary toensure its availability and stability to support PBAPS. Theavailability of this highly reliable source of offsite powerpermits an extension of the allowable out of service timefor a DG to 14 days from the discovery of failure to meetLCO 3.8.1.a or b (per Required Action B.5). Therefore, whena DG is inoperable, it is necessary to verify theavailability of the Conowingo Tie-Line immediately and onceper 12 hours thereafter. The Completion Time of"Immediately" reflects the fact that in order to ensure thatthe full 14 day Completion Time of Required Action B.5 isavailable for completing preplanned maintenance of a DG,prudent plant practice at PBAPS dictates that theavailability of the Conowingo Tie-Line be verified prior tomaking a DG inoperable for preplanned maintenance. TheConowingo Tie-Line is available and satisfies therequirements of Required Action B.1 if: 1) the Conowingoline is supplying power to the 13.8kV SBO Switchgear 00A306;2) all equipment required, per SE-lI, to connect power fromthe Conowingo Tie-Line to the emergency 4kV buses and toisolate all non-SBO loads from the Conowingo Tie-Line isavailable and accessible;; and 3) communications with theConowingo control room indicate that required equipment atConowingo is available. If Required Action B.1 is not met orthe

(continued)



BASES

ACTIONS B.l (continued)

status of the Conowingo Tie-Line changes after RequiredAction B.1 is initially met, Condition C must be immediatelyentered.

B.2

To ensure a highly reliable power source remains with one DGinoperable, it is necessary to verify the availability ofthe required offsite circuits on a more frequent basis.Since the Required Action only specifies "perform," afailure of SR 3.8.1.1 acceptance criteria does not result ina Required Action being not met. However, if a circuitfails to pass SR 3.8.1.1, it is inoperable. Upon offsitecircuit inoperability, additional Conditions must then beentered.

B.3

Required Action B.3 is intended to provide assurance that aloss of offsite power, during the period that a DG isinoperable, does not result in a complete loss of safetyfunction of critical systems. These features are designedto be powered from redundant safety related 4 kV emergencybuses. Redundant required features failures consist ofinoperable features associated with an emergency busredundant to the emergency bus that has an inoperable DG.

The Completion Time is intended to allow the operator timeto evaluate and repair any discovered inoperabilities. ThisCompletion Time also allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."In this Required Action the Completion Time only begins ondiscovery that both:

a. An inoperable DG exists; and

b. A redundant required feature on another 4 kV emergencybus is inoperable.

If, at any time during the existence of this Condition (oneDG inoperable), a required feature subsequently becomesinoperable, this Completion Time begins to be tracked.

Discovering one DG inoperable coincident with one or moreinoperable required support or supported features, or both,that are associated with the OPERABLE DGs results in

(continued)



BASES


starting the Completion Time for the Required Action. Fourhours from the discovery of these events existingconcurrently is acceptable because it minimizes risk whileallowing time for restoration before subjecting the unit totransients associated with shutdown.

The remaining OPERABLE DGs and offsite circuits are adequateto supply electrical power to the onsite Class 1EDistribution System. Thus, on a component basis, singlefailure protection for the required feature's function mayhave been lost; however, function has not been lost. The4 hour Completion Time takes into account the componentOPERABILITY of the redundant counterpart to the inoperablerequired feature. Additionally, the 4 hour Completion Timetakes into account the capacity and capability of theremaining AC sources, reasonable time for repairs, and lowprobability of a DBA occurring during this period.

B.4.1 and B.4.2

Required Action B.4.1 provides an allowance to avoidunnecessary testing of OPERABLE DGs. If it can bedetermined that the cause of the inoperable DG does notexist on the OPERABLE DGs, SR 3.8.1.2 does not have to beperformed. If the cause of inoperability exists on otherDG(s), they are declared inoperable upon discovery, andCondition F or H of LCO 3.8.1 is entered, as applicable.Once the failure is repaired, and the common cause failureno longer exists, Required Action B.4.1 is satisfied. Ifthe cause of the initial inoperable DG cannot be confirmednot to exist on the remaining DGs, performance of SR 3.8.1.2suffices to provide assurance of continued OPERABILITY ofthose DGs.

In the event the inoperable DG is restored to OPERABLEstatus prior to completing either B.4.1 or B.4.2, the PBAPSCorrective Action Program will continue to evaluate thecommon cause possibility. This continued evaluation,however, is no longer required under the 24 hour constraintimposed while in Condition B.

According to Generic Letter 84-15 (Ref. 5), 24 hours is areasonable time to confirm that the OPERABLE DGs are notaffected by the same problem as the inoperable DG.

(continued)



BASES


The availability of the Conowingo Tie-Line provides anadditional source which permits operation to continue inCondition B for a period that should not exceed 14 days fromdiscovery of the failure to meet LCO 3.8.1.a or b. InCondition B, the remaining OPERABLE DGs and the normaloffsite circuits are adequate to supply electrical power tothe onsite Class 1E Distribution System. The CompletionTime of Required Action B.5 takes into account the enhancedreliability and availability of offsite sources due to theConowingo Tie-Line, the redundancy, capacity, and capabilityof the other remaining AC sources, reasonable time forrepairs of the affected DG, and low probability of a DBAoccurring during this period.

The Completion Time for Required Action B.5 also establishesa limit on the maximum time allowed for any combination ofrequired AC power sources to be inoperable during any singlecontiguous occurrence of failing to meet LCO 3.8.1.a or b.If Condition B is entered while, for instance, an offsitecircuit is inoperable and that circuit is subsequentlyrestored OPERABLE, the LCO may already have been not met forup to 7 days. This situation could lead to a total of 14days, since initial'failure of LCO 3.8.1.a or b, to restorethe DG. At this time, an offsite circuit could again becomeinoperable, the DG restored OPERABLE, and an additional7 days (for a total of 21 days) allowed prior to completerestoration of the LCO. The 14 day Completion Time providesa limit on the time allowed in a specified condition afterdiscovery of failure to meet LCO 3.8.1.a or b. This limitis considered reasonable for situations in whichConditions A and B are entered concurrently. The 14 dayCompletion Time would also limit the maximum time a DG isinoperable if the status of the Conowingo Tie-Line changesfrom being available to being not available (this isdiscussed in Required Action C.1 Bases discussion).

As in Required Action B.3, the Completion Time allows for anexception to the normal "time zero" for beginning theallowed outage time "clock." This exception results inestablishing the "time zero" at the time that the LCO wasinitially not met, instead of the time that Condition B wasentered.

(continued)



BASES


The extended Completion Time for restoration of aninoperable DG afforded by the availability of the ConowingoTie-Line is intended to allow completion of a dieselgenerator overhaul; however, subject to the diesel generatorreliability program, INPO performance criteria, and goodoperating practices, using the extended Completion Time ispermitted for other reasons. Activities or conditions thatincrease the probability of a loss of offsite power (i.e.,switchyard maintenance or severe weather) should beconsidered when scheduling a diesel generator outage. Inaddition, the effect of other inoperable plant equipmentshould be considered when scheduling a diesel generatoroutage.

C.1

If the availability of the Conowingo Tie-Line is notverified within the Completion Time of Required Action B.1,or if the status of the Conowingo Tie-Line changes afterRequired Action B.1 is initially met, the DG must berestored to OPERABLE status within 7 days. The 7-dayCompletion-Time begins upon entry into Condition C (i.e.,upon discovery of failure to meet Required Action B.1).However, the total time to restore an inoperable DG cannotexceed 14 days (per the Completion Time of Required ActionB.5).

The 4 kV emergency bus design and loading is sufficient toallow operation to continue in Condition B for a period thatshould not exceed 7 days, if the Conowingo Tie-Line is notavailable (refer to Required Action B.1 Bases discussion).In Condition C, the remaining OPERABLE DGs and offsitecircuits are adequate to supply electrical power to theonsite Class ]E Distribution System. The 7 day CompletionTime takes into account the redundancy, capacity, andcapability of the remaining AC sources, reasonable time forrepairs, and low probability of a DBA occurring during thisperiod.

(continued)



BASES

ACTIONS D.1 and D.2(continued)

Required Action D.1 addresses actions to be taken in theevent of inoperability of redundant required featuresconcurrent with inoperability of two or more offsitecircuits. Required Action D.1 reduces the vulnerability toa loss of function. The Completion Time for taking theseactions is reduced to 12 hours from that allowed with one4 kV emergency bus without offsite power (RequiredAction A.2). The rationale for the reduction to 12 hours isthat Regulatory Guide 1.93 (Ref. 6) allows a Completion Timeof 24 hours for two offsite circuits inoperable, based uponthe assumption that two complete safety divisions areOPERABLE. (While this Action allows more than two circuitsto be inoperable, Regulatory Guide 1.93 assumed two circuitswere all that were required by the LCO, and a loss of thosetwo circuits resulted in a loss of all offsite power to theClass IE AC Electrical Power Distribution System. Thus,with the Peach Bottom Atomic Power Station design, a loss ofmore than two offsite circuits results in the sameconditions assumed in Regulatory Guide 1.93.) When aconcurrent redundant required feature failure exists, thisassumption is not the case, and a shorter Completion Time of12 hours is appropriate. These features are designed withredundant safety related 4 kV emergency buses. Redundantrequired features failures consist of any of these featuresthat are inoperable because any inoperability is on anemergency bus redundant to an emergency bus with inoperableoffsite circuits.

The Completion Time for Required Action D.1 is intended toallow the operator time to evaluate and repair anydiscovered inoperabilities. This Completion Time alsoallows for an exception to the normal "time zero" forbeginning the allowed outage time "clock." In this RequiredAction, the Completion Time only begins on discovery thatboth:

a. Two or more offsite circuits are inoperable; and

b. A required feature is inoperable.

(continued)



BASES


If, at any time during the existence of this Condition (twoor more offsite circuits inoperable i.e., any combination ofUnit 2 and Unit 3 offsite circuits inoperable), a requiredfeature subsequently becomes inoperable, this CompletionTime begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation maycontinue in Condition D for a period that should not exceed24 hours. This level of degradation means that the offsiteelectrical power system may not have the capability toeffect a safe shutdown and to mitigate the effects of anaccident; however, the onsite AC sources have not beendegraded. This level of degradation generally correspondsto a total loss of the immediately accessible offsite powersources.

Because of the normally high availability of the offsitesources, this level of degradation may appear to be moresevere than other combinations of two AC sources inoperablethat involve one or more DGs inoperable. However, twofactors tend to decrease the severity of this degradationlevel:

a. The configuration of the redundant AC electrical powersystem that remains available is not susceptible to asingle bus or switching failure; and

b. The time required to detect and restore an unavailableoffsite power source is generally much less than thatrequired to detect and restore an unavailable onsiteAC source.

With two or more of the offsite circuits inoperable,sufficient onsite AC sources are available to maintain theunit in a safe shutdown condition in the event of a DBA ortransient. In fact, a simultaneous loss of offsite ACsources, a LOCA, and a worst case single failure werepostulated as a part of the design basis in the safetyanalysis. Thus, the 24 hour Completion Time provides aperiod of time to effect restoration of all but one of theoffsite circuits commensurate with the importance ofmaintaining an AC electrical power system capable of meetingits design criteria.

(continued)



BASES


According to Regulatory Guide 1.93 (Ref. 6), with theavailable offsite AC sources two less than required by theLCO, operation may continue for 24 hours. If all offsitesources are restored within 24 hours, unrestricted operationmay continue. If all but one offsite source is restoredwithin 24 hours, power operation continues in accordancewith Condition A.

E.1 and E.2

Pursuant to LCO 3.0.6, the Distribution Systems-OperatingACTIONS would not be entered even if all AC sources to itwere inoperable, resulting in de-energization. Therefore,the Required Actions of Condition E are modified by a Noteto indicate that when Condition E is entered with no ACsource to any 4 kV emergency bus, ACTIONS for LCO 3.8.7,"Distribution Systems-Operating," must be immediatelyentered. This allows Condition E to provide requirementsfor the loss of the offsite circuit and one DG withoutregard to whether a 4 kV emergency bus is de-energized.LCO 3.8.7 provides the appropriate restrictions for ade-energized 4 kV emergency bus.

According to Regulatory Guide 1.93 (Ref. 6), operation maycontinue in Condition E for a period that should not exceed12 hours. In Condition E, individual redundancy is lost inboth the offsite electrical power system and the onsite ACelectrical power system. Since power system redundancy isprovided by two diverse sources of power, however, thereliability of the power systems in this Condition mayappear higher than that in Condition D (loss of two or moreoffsite circuits). This difference in reliability is offsetby the susceptibility of this power system configuration toa single bus or switching failure. The 12 hour CompletionTime takes into account the capacity and capability of theremaining AC sources, reasonable time for repairs, and thelow probability of a DBA occurring during this period.

(continued)

PBAPS UNIT 2 B. 3.8-16 Revision No. 0


BASES

ACTIONS F.1(continued)

With two or more DGs inoperable, with an assumed loss ofoffsite electrical power, insufficient standby AC sourcesare available to power the minimum required ESF functions.Since the offsite electrical power system is the only sourceof AC power for the majority of ESF equipment at this levelof degradation, the risk associated with continued operationfor a very short time could be less than that associatedwith an immediate controlled shutdown. (The immediateshutdown could cause grid instability, which could result ina total loss of AC power.) Since any inadvertent unitgenerator trip could also result in a total loss of offsiteAC power, however, the time allowed for continued operationis severely restricted. The intent here is to avoid therisk associated with an immediate controlled shutdown and tominimize the risk associated with this level of degradation.

According to Regulatory Guide 1.93 (Ref. 6), with two ormore DGs inoperable, operation may continue for a periodthat should not exceed 2 hours. (Regulatory Guide 1.93assumed the unit has two DGs. Thus, a loss of both DGsresults in a total loss of onsite power. Therefore, a lossof more than two DGs, in the Peach Bottom Atomic PowerStation design, results in degradation no worse than thatassumed in Regulatory Guide 1.93.)

G.1 and G.2

If the inoperable AC electrical power source(s) cannot berestored to OPERABLE status within the associated CompletionTime (Required Action and associated Completion Time ofCondition A, C, D, E, or F not met; or Required Action B.2,B.3, B.4.1, B.4.2, or B.5 and associated Completion Time notmet), the unit must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the unit must bebrought to at least MODE 3 within 12 hours and to MODE 4within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.

(continued)


AC Sources--OperatingB 3.8.1

BASES

ACTIONS H.1(continued)

Condition H corresponds to a level of degradation in whichredundancy in the AC electrical power supplies has beenlost. At this severely degraded level, any further lossesin the AC electrical power system may cause a loss offunction. Therefore, no additional time is justified forcontinued operation. The unit is required by LCO 3.0.3 tocommence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection andREQUIREMENTS testing of all important areas and features, especially

those that have a standby function, in accordance withUFSAR, Section 1.5.1 (Ref. 7). Periodic component tests aresupplemented by extensive functional tests during refuelingoutages (under simulated accident conditions). The SRs fordemonstrating the OPERABILITY of the DGs are consistent withthe recommendations of Regulatory Guide 1.9 (Ref. 3),Regulatory Guide 1.108 (Ref. 8), and Regulatory Guide 1.137(Ref. 9).

As Noted at the beginning of the SRs, SR 3.8.1.1 throughSR 3.8.1.20 are applicable only to the Unit 2 AC sources andSR 3.8.1.21 is applicable only to the Unit 3 AC sources.

Where the SRs discussed herein specify voltage and frequencytolerances, the following summary is applicable. Theminimum steady state output voltage of 4160 V corresponds tothe minimum steady state voltage analyzed in the PBAPSemergency DG voltage regulation study. This value allowsfor voltage drops to motors and other equipment down throughthe 120 V level. The specified maximum steady state outputvoltage of 4400 V is equal to the maximum steady stateoperating voltage specified for 4000 V motors. It ensuresthat for a lightly loaded distribution system, the voltageat the terminals of 4000 V motors is no more than themaximum rated steady state operating voltages. Thespecified minimum and maximum frequencies of the DG are58.8 Hz and 61.2 Hz, respectively. These values are equalto ± 2% of the 60 Hz nominal frequency and are derived fromthe recommendations found in Regulatory Guide 1.9 (Ref. 3).

(continued)



BASES


(continued)

SR 3.8.1.1

This SR ensures proper circuit continuity for the offsite ACelectrical power supply to the onsite distribution networkand availability of offsite AC electrical power. Thebreaker alignment verifies that each breaker is in itscorrect position to ensure that distribution buses and loadsare connected to their preferred power source and thatappropriate independence of offsite circuits is maintained.The 7 day Frequency is adequate since breaker position isnot likely to change without the operator being aware of itand because its status is displayed in the control room.

SR 3.8.1.2 and SR 3.8.1.7

These SRs help to ensure the availability of the standbyelectrical power supply to mitigate DBAs and transients andmaintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not getlubricated when the engine is not running, these SRs havebeen modified by a Note (Note 2 for SR 3.8.1.2 and Note 1for SR 3.8.1.7) to indicate that all DG starts for theseSurveillances may be preceded by an engine prelube periodand followed by a warmup prior to loading.

For the purposes of this testing, the DGs are started fromstandby conditions. Standby conditions for a DG mean thatthe diesel engine coolant and oil are being continuouslycirculated and temperature is being maintained consistentwith manufacturer recommendations.

In order to reduce stress and wear on diesel engines, themanufacturer recommends a modified start in which thestarting speed of DGs is limited, warmup is limited to thislower speed, and the DGs are gradually accelerated tosynchronous speed prior to loading. These start proceduresare the intent of Note 3 to SR 3.8.1.2, which is onlyapplicable when such modified start procedures arerecommended by the manufacturer.

SR 3.8.1.7 requires that, at a 184 day Frequency, the DGstarts from standby conditions and achieves required voltageand frequency within 10 seconds. The minimum voltage andfrequency stated in the SR are those necessary to ensure the

(continued)



BASES


DG can accept DBA loading while maintaining acceptablevoltage and frequency levels. Stable operation at thenominal voltage and frequency values is also essential toestablishing DG OPERABILITY, but a time constraint is notimposed. This is because a typical DG will experience aperiod of voltage and frequency oscillations prior toreaching steady state operation if these oscillations arenot damped out by load application. This period may extendbeyond the 10 second acceptance criteria and could be acause for failing the SR. In lieu of a time constraint inthe SR, PBAPS will monitor and trend the actual time toreach steady state operation as a means of ensuring there isno voltage regulator or governor degradation which couldcause a DG to become inoperable. The 10 second startrequirement supports the assumptions in the design basisLOCA analysis of UFSAR, Section 8.5 (Ref. 10). The10 second start requirement is not applicable to SR 3.8.1.2(see Note 3 of SR 3.8.1.2), when a modified start procedureas described above is used. If a modified start is notused, the 10 second start requirement of SR 3.8.1.7 applies.

Since SR 3.8.1.7 requires a 10 second start, it is morerestrictive than SR 3.8.1.2, and it may be performed in lieuof SR 3.8.1.2. This procedure is the intent of Note 1 ofSR 3.8.1.2.

To minimize testing of the DGs, Note 4 to SR 3.8.1.2 andNote 2 to SR 3.8.1.7 allow a single test (instead of twotests, one for each unit) to satisfy the requirements forboth units. This is allowed since the main purpose of theSurveillance can be met by performing the test on eitherunit. If the DG fails one of these Surveillances, the DGshould be considered inoperable on both units, unless thecause of the failure can be directly related to only oneunit.

The normal 31 day Frequency for SR 3.8.1.2 is consistentwith Regulatory Guide 1.9 (Ref. 3). The 184 day Frequencyfor SR 3.8.1.7 is a reduction in cold testing consistentwith Generic Letter 84-15 (Ref. 5). These Frequenciesprovide adequate assurance of DG OPERABILITY, whileminimizing degradation resulting from testing.

(continued)



BASES


(continued) This Surveillance verifies that the DGs are capable ofsynchronizing and accepting a load approximately equivalentto that corresponding to the continuous rating. A minimumrun time of 60 minutes is required to stabilize enginetemperatures, while minimizing the time that the DG isconnected to the offsite source.

This Surveillance verifies, indirectly, that the DGs arecapable of synchronizing and accepting loads equivalent topost accident loads. The DGs are tested at a loadapproximately equivalent to their continuous duty rating,even though the post accident loads exceed the continuousrating. This is acceptable because regular surveillancetesting at post accident loads is injurious to the DG, andimprudent because the same level of assurance in the abilityof the DG to provide post accident loads can be developed bymonitoring engine parameters during surveillance testing.The values of the testing parameters can then bequalitatively compared to expected values at post accidentengine loads. In making this comparison it is necessary toconsider the engine parameters as interrelated indicators ofremaining DG capacity, rather than independent indicators.The important engine parameters to be considered in makingthis comparison include, fuel rack position, scavenging airpressure, exhaust temperature and pressure, engine output,jacket water temperature, and lube oil temperature. Withthe DG operating at or near continuous rating and theobserved values of the above parameters less than expectedpost accident values, a qualitative extrapolation whichshows the DG is capable of accepting post accident loads canbe made without requiring detrimental testing.

Although no power factor requirements are established bythis SR, the DG is normally operated at a power factorbetween 0.8 lagging and 1.0. The 0.8 value is the designrating of the machine, while 1.0 is an operationallimitation. The load band is provided to avoid routineoverloading of the DG. Routine overloading may result inmore frequent teardown inspections in accordance with vendorrecommendations in order to maintain DG OPERABILITY.

The normal 31 day Frequency for this Surveillance isconsistent with Regulatory Guide 1.9 (Ref. 3).

(continued)



BASES


Note I modifies this Surveillance to indicate that dieselengine runs for this Surveillance may include gradualloading, as recommended by the manufacturer, so thatmechanical stress and wear on the diesel engine areminimized.

Note 2 modifies this Surveillance by stating that momentarytransients because of changing bus loads do not invalidatethis test. Similarly, momentary power factor transientsabove the limit do not invalidate the test.

Note 3 indicates that this Surveillance should be conductedon only one DG at a time in order to avoid common causefailures that might result from offsite circuit or gridperturbations.

Note 4 stipulates a prerequisite requirement for performanceof this SR. A successful DG start must precede this test tocredit satisfactory performance.

To minimize testing of the DGs, Note 5 allows a single test(instead of two tests, one for each unit) to satisfy therequirements for both units, with the DG synchronized to the4 kV emergency bus of Unit 2 for one periodic test andsynchronized to the 4 kV emergency bus of Unit 3 during thenext periodic test. This is allowed since the main purposeof the Surveillance, to ensure DG OPERABILITY, is stillbeing verified on the proper frequency, and each unit'sbreaker control circuitry, which is only being tested everysecond test (due to the staggering of the tests),

historically have a very low failure rate. Note 5 modifiesthe specified frequency for each unit's breaker controlcircuitry to be 62 days. If the DG fails one of theseSurveillances, the DG should be considered inoperable onboth units, unless the cause of the failure can be directlyrelated to only one unit. In addition, if the test isscheduled to be performed on Unit 3, and the Unit 3 TSallowance that provides an exception to performing the testis used (i.e., when Unit 3 is in MODE 4 or 5, or movingirradiated fuel assemblies in the secondary containment, theNote to Unit 3 SR 3.8.2.1 provides an exception toperforming this test) or if it is not preferable to performthe test on a unit due to operational concerns (however timeis not to exceed 62 days plus grace), then the test shall beperformed synchronized to the Unit 2 4 kV emergency bus.

(continued)



BASES


(continued) This allowance is acceptable provided that the associatedunit's breaker control circuitry portion of the Surveillanceis performed within the SR frequency of 62 days plus SR3.0.2 allowed grace period or the next scheduledSurveillance after the Technical Specification allowance isno longer applicable.

This SR provides verification that the level of fuel oil inthe day tank is adequate for a minimum of I hour of DGoperation at full load. The level, which includes margin toaccount for the unusable volume of oil, is expressed as anequivalent volume in gallons.

The 31 day Frequency is adequate to ensure that a sufficientsupply of fuel oil is available, since low level alarms areprovided and facility operators would be aware of any largeuses of fuel oil during this period.

SR 3.8.1.5

Microbiological fouling is a major cause of fuel oildegradation. There are numerous bacteria that can grow infuel oil and cause fouling, but all must have a waterenvironment in order to survive. Removal of water from thefuel oil day tanks once every 31 days eliminates thenecessary environment for bacterial survival. This is themost effective means of controlling microbiological fouling.In addition, it eliminates the potential for waterentrainment in the fuel oil during DG operation. Water maycome from any of several sources, including condensation,ground water, rain water, contaminated fuel oil, andbreakdown of the fuel oil by bacteria. Frequent checkingfor and removal of accumulated water minimizes fouling andprovides data regarding the watertight integrity of the fueloil system. The Surveillance Frequencies are consistentwith Regulatory Guide 1.137 (Ref. 9). This SR is forpreventive maintenance. The presence of water does notnecessarily represent a failure of this SR provided that.accumulated water is removed during performance of thisSurveillance.

SR 3.8.1.6

This Surveillance demonstrates that each required fuel oiltransfer pump operates and automatically transfers fuel oilfrom its associated storage tank to its associated day tank.It is required to support continuous operation of standbypower sources. This Surveillance provides assurance that



BASES


the fuel oil transfer pump is OPERABLE, the fuel oil pipingsystem is intact, the fuel delivery piping is notobstructed, and the controls and control systems forautomatic fuel transfer systems are OPERABLE.

Manual operator action may be used during performance ofsurveillance testing, in lieu of automatic action and willmaintian the automatic transfer system operable. Theoperator actions will be administratively controlled by theprocedures.

The Frequency for this SR is 31 days because the design ofthe fuel transfer system is such that pumps operateautomatically in order to maintain an adequate volume offuel oil in the day tanks during or following DG testing andproper operation of fuel transfer systems is an inherentpart of DG OPERABILITY.

SR 3.8.1.8

Transfer of each 4 kV emergency bus power supply from thenormal offsite circuit to the alternate offsite circuitdemonstrates the OPERABILITY of the alternate circuitdistribution network to power the shutdown loads. The24 month Frequency of the Surveillance is based onengineering judgment taking into consideration the plantconditions required to perform the Surveillance, and isintended to be consistent with expected fuel cycle lengths.Operating experience has shown that these components willpass the SR when performed on the 24 month Frequency.Therefore, the Frequency was concluded to be acceptable froma reliability standpoint.

This SR is modified by a Note. The reason for the Note isthat, during operation with the reactor critical,performance of this SR could cause perturbations to theelectrical distribution systems that could challengecontinued steady state operation and, as a result, plantsafety systems. This Surveillance tests the applicablelogic associated with Unit 2. The comparable test specifiedin Unit 3 Technical Specifications tests the applicablelogic associated with Unit 3. Consequently, a test must beperformed within the specified Frequency for each unit. Asthe Surveillance represents separate tests, the Note

(continued)



BASES


specifying the restriction for not performing the test whilethe unit is in MODE 1 or 2 does not have applicability toUnit 3. The Note only applies to Unit 2, thus the Unit 2Surveillance shall not be performed with Unit 2 in MODE 1 or2. Credit may be taken for unplanned events that satisfythis SR.

SR 3.8.1.9

Each DG is provided with an engine overspeed trip to preventdamage to the engine. Recovery from the transient caused bythe loss of a large load could cause diesel engineoverspeed, which, if excessive, might result in a trip ofthe engine. This Surveillance demonstrates the DG loadresponse characteristics and capability to reject thelargest single load without exceeding predetermined voltageand frequency and while maintaining a specified margin tothe overspeed trip. The largest single load for each DG isa residual heat removal pump (2000 bhp). This Surveillancemay be accomplished by: 1) tripping the DG output breakerswith the DG carrying greater than or equal to its associatedsingle largest post-accident load while paralleled tooffsite power, or while solely supplying the bus, or 2)tripping its associated single largest post-accident loadwith the DG solely supplying the bus. Currently, the secondoption is the method PBAPS utilizes because the first methodwill result in steady state operation outside the allowablevoltage and frequency limits. Consistent with RegulatoryGuide 1.9 (Ref. 3), the load rejection test is acceptable ifthe diesel speed does not exceed the nominal (synchronous)speed plus 75% of the difference between nominal speed andthe overspeed trip setpoint, or 115% of nominal speed,whichever is lower.

The time, voltage, and frequency tolerances specified inthis SR are derived from Regulatory Guide 1.9 (Ref. 3)recommendations for response during load sequence intervals.The 1.8 seconds specified for voltage and the 2.4 secondsspecified for frequency are equal to 60% and 80%,respectively, of the 3 second load sequence intervalassociated with sequencing the next load following theresidual heat removal (RHR) pumps during an undervoltage onthe bus concurrent with a LOCA. The voltage and frequencyspecified are consistent with the design range of the

(continued)



BASES


equipment powered by the DG. SR 3.8.1.9.a corresponds tothe maximum frequency excursion, while SR 3.8.1.9.b andSR 3.8.1.9.c provide steady state voltage and frequencyvalues to which the system must recover following loadrejection. The 24 month Frequency takes into considerationplant conditions required to perform the Surveillance, andis intended to be consistent with expected fuel cyclelengths.

This SR is modified by two Notes. Note 1 ensures that the DGis tested under load conditions that are as close to designbasis conditions as possible. When synchronized with offsitepower, testing should be performed at a power factor of• 0.89. This power factor is representative of the actualinductive loading a DG would see under design basis accidentconditions. Under certain conditions, however, Note 1 allowsthe Surveillance to be conducted at a power factor other than• 0.89. These conditions occur when grid voltage is high,and the additional field excitation needed to get the powerfactor to • 0.89 results in voltages on the emergency bussesthat are too high. Under these conditions, the power factorshould be maintained as close as practicable to 0.89 whilestill maintaining acceptable voltage limits on the emergencybusses. In other circumstances, the grid voltage may be suchthat the DG excitation levels needed to obtain a power factorof 0.89 may not cause unacceptable voltages on the emergencybusses, but the excitation levels are in excess of thoserecommended for the DG. In such cases, the power factorshall be maintained as close as practicabl.e to 0.89 withoutexceeding the DG excitation limits.

To minimize testing of the DGs, Note 2 allows a single test(instead of two tests, one for each unit) to satisfy therequirements for both units. This is allowed since the mainpurpose of the Surveillance can be met by performing thetest on either unit. If the DG fails one of theseSurveillances, the DG should be considered inoperable onboth units, unless the cause of the failure can be directlyrelated to only one unit.

(continued)



BASES


Consistent with Regulatory Guide 1.9 (Ref. 3),paragraph C.2.2.8, this Surveillance demonstrates the DGcapability to reject a full load without overspeed trippingor exceeding the predetermined voltage limits. The DG fullload rejection may occur because of a system fault orinadvertent breaker tripping. This Surveillance ensuresproper engine generator load response under the simulatedtest conditions. This test simulates the loss of the totalconnected load that the DG experiences following a full loadrejection and verifies that the DG does not trip upon lossof the load. These acceptance criteria provide DG damageprotection. While the DG is not expected to experience thistransient during an event, and continue to be available,this response ensures that the DG is not degraded for futureapplication, including reconnection to the bus if the tripinitiator can be corrected or isolated.

The 24 month Frequency takes into consideration plantconditions required to perform the Surveillance, and isintended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. Note I ensures that theDG is tested under load conditions that are as close todesign basis conditions as possible. When synchronized withoffsite power, testing should be performed at a power factorof • 0.89. This power factor is representative of theactual inductive loading a DG would see under design basisaccident conditions. Under certain conditions, however,Note I allows the Surveillance to be conducted at a powerfactor other than • 0.89. These conditions occur when gridvoltage is high, and the additional field excitation neededto get the power factor to • 0.89 results in voltages on theemergency busses that are too high. Under these conditions,the power factor should be maintained as close aspracticable to 0.89 while still maintaining acceptablevoltage limits on the emergency busses. In othercircumstances, the grid voltage may be such that the DGexcitation levels needed to obtain a power factor of 0.89may not cause unacceptable voltages on the emergency busses,

(continued)


AC Sources--OperatingB 3.8.1

BASES


but the excitation levels are in excess of those recommendedfor the DG. In such cases, the power factor shall bemaintained as close as practicable to 0.89 without exceedingthe DG excitation limits. To minimize testing of the DGs,Note 2 allows a single test (instead of two tests, one foreach unit) to satisfy the requirements for both units. Thisis allowed since the main purpose of the Surveillance can bemet by performing the test on either unit. If the DG failsone of these Surveillances, the DG should be consideredinoperable on both units, unless the cause of the failurecan be directly related to only one unit.

SR 3.8.1.11

Consistent with Regulatory Guide 1.9 (Ref. 3),paragraph C.2.2.4, this Surveillance demonstrates the asdesigned operation of the standby power sources during lossof the offsite source. This test verifies all actionsencountered from the loss of offsite power, includingshedding of all loads and energization of the emergencybuses and respective loads from the DG. It furtherdemonstrates the capability of the DG to automaticallyachieve the required voltage and frequency within thespecified time.

The DG auto-start and energization of the associated 4 kVemergency bus time of 10 seconds is derived fromrequirements of the accident analysis for responding to adesign basis large break LOCA. The Surveillance should becontinued for a minimum of 5 minutes in order to demonstratethat all starting transients have decayed and stability hasbeen achieved.

(continued)



BASES


The requirement to verify the connection and power supply ofauto-connected loads is intended to satisfactorily show therelationship of these loads to the DG loading logic. Incertain circumstances, many of these loads cannot actuallybe connected or loaded-without undue hardship or potentialfor undesired operation. For instance, Emergency CoreCooling Systems (ECCS) injection valves are not desired tobe stroked open, or systems are not capable of beingoperated at full flow, or RHR systems performing a decayheat removal function are not desired to be realigned to theECCS mode of operation. In lieu of actual demonstration ofthe connection and loading of these loads, testing thatadequately shows the capability of the DG system to performthese functions is acceptable. This testing may include anyseries of sequential, overlapping, or total steps so thatthe entire connection and loading sequence is verified.

The Frequency of 24 months takes into consideration plantconditions required to perform the Surveillance, and isintended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. The reason for Note I isto minimize wear and tear on the DGs during testing. Forthe purpose of this testing, the DGs shall be started fromstandby conditions, that is, with the engine coolant and oilbeing continuously circulated and temperature maintainedconsistent with manufacturer recommendations. The reasonfor Note 2 is that performing the Surveillance would removea required offsite circuit from service, perturb theelectrical distribution system, and challenge safetysystems. This Surveillance tests the applicable logicassociated with Unit 2. The comparable test specified inthe Unit 3 Technical Specifications tests the applicablelogic associated with Unit 3. Consequently, a test must beperformed within the specified Frequency for each unit. Asthe Surveillance represents separate tests, the Notespecifying the restriction for not performing the test whilethe unit is in MODE 1, 2, or 3 does not have applicabilityto Unit 3. The Note only applies to Unit 2, thus the Unit 2Surveillances shall not be performed with Unit 2 in MODE 1,2, or 3. Credit may be taken for unplanned events thatsatisfy this SR.

(continued)



BASES

SURVEILLANCEREQUIREMENTS SR 3.8.1.12

(continued)Consistent with Regulatory Guide 1.9 (Ref. 3),paragraph C.2.2.5, this Surveillance demonstrates that theDG automatically starts and achieves the required voltageand frequency within the specified time (10 seconds) fromthe design basis actuation signal (LOCA signal) and operatesfor Ž 5 minutes. The minimum voltage and frequency statedin the SR are those necessary to ensure the DG can acceptDBA loading while maintaining acceptable voltage andfrequency levels. Stable operation at the nominal voltageand frequency values is also essential to establishing DGOPERABILITY, but a time constraint is not imposed. This isbecause a typical DG will experience a period of voltage andfrequency oscillations prior to reaching steady stateoperation if these oscillations are not damped out by loadapplication. This period may extend beyond the 10 secondacceptance criteria and could be a cause for failing the SR.In lieu of a time constraint in the SR, PBAPS will monitorand trend the actual time to reach steady state operation asa means of ensuring there is no voltage regulator orgovernor degradation which could cause a DG to becomeinoperable. The 5 minute period provides sufficient time todemonstrate stability. SR 3.8.1.12.d andSR 3.8.1.12.e ensure that permanently connected loads andemergency loads are energized from the offsite electricalpower system on a LOCA signal without loss of offsite power.

The requirement to verify the connection and power supply ofpermanent and autoconnected loads is intended tosatisfactorily show the relationship of these loads to theloading logic for loading onto offsite power. In certaincircumstances, many of these loads cannot actually beconnected or loaded without undue hardship or potential forundesired operation. For instance, ECCS injection valvesare not desired to be stroked open, ECCS systems are notcapable of being operated at full flow, or RHR systemsperforming a decay heat removal function are not desired tobe realigned to the ECCS mode of operation. In lieu ofactual demonstration of the connection and loading of theseloads, testing that adequately shows the capability of theDG system to perform these functions is acceptable. Thistesting may include any series of sequential, overlapping,or total steps so that the entire connection and loadingsequence is verified.

(continued)



BASES


The Frequency of 24 months takes into consideration plantconditions required to perform the Surveillance and isintended to be consistent with the expected fuel cyclelengths.

This SR is modified by a Note. The reason for the Note isto minimize wear and tear on the DGs during testing. Forthe purpose of this testing, the DGs must be started fromstandby conditions, that is, with the engine coolant and oilbeing continuously circulated and temperature maintainedconsistent with manufacturer recommendations.

SR 3.8.1.13

Consistent with Regulatory Guide 1.9 (Ref. 3),paragraph C.2.2.12, this Surveillance demonstrates that DGnon-critical protective functions (e.g., high jacket watertemperature) are bypassed on an ECCS initiation test signaland critical protective functions (engine overspeed,generator differential overcurrent, generator ground neutralovercurrent, and manual cardox initiation) trip the DG toavert substantial damage to the DG unit. The non-criticaltrips are bypassed during DBAs and continue to provide analarm on an abnormal engine condition. This alarm providesthe operator with sufficient time to react appropriately.The DG availability to mitigate the DBA is more criticalthan protecting the engine against minor problems that arenot immediately detrimental to emergency operation of theDG.

The 24 month Frequency is based on engineering judgment,takes into consideration plant conditions required toperform the Surveillance, and is intended to be consistentwith expected fuel cycle lengths.

To minimize testing of the DGs, the Note to this SR allows asingle test (instead of two tests, one for each unit) tosatisfy the requirements for both units. This is allowedsince the main purpose of the Surveillance can be met byperforming the test on either unit. If the DG fails one ofthese Surveillances, the DG should be considered inoperableon both units, unless the cause of the failure can bedirectly related to only one unit.

(continued)



BASES


(continued)

SR 3.8.1.14

Consistent with Regulatory Guide 1.9 (Ref. 3),paragraph C.2.2.9, this Surveillance requires demonstrationthat the DGs can start and run continuously at full loadcapability for an interval of not less than 24 hours.However, load values may deviate from the Regulatory Guidesuch that the DG operates for 22 hours at a loadapproximately equivalent to 92% to 108% of the continuousduty rating of the DG, and 2 hours of which is at a loadapproximately equivalent to 108% to 115% of the continuousduty rating of the DG. The DG starts for this Surveillancecan be performed either from standby or hot conditions. Theprovisions for prelube and warmup, discussed in SR 3.8.1.2,and for gradual loading, discussed in SR 3.8.1.3, areapplicable to this SR.

This Surveillance verifies, indirectly, that the DGs arecapable of synchronizing and accepting loads equivalent topost accident loads. The DGs are tested at a loadapproximately equivalent to their continuous duty rating,even though the post accident loads exceed the continuousrating. This is acceptable because regular surveillancetesting at post accident loads is injurious to the DG, andimprudent because the same level of assurance in the abilityof the DG to provide post accident loads can be developed bymonitoring engine parameters during surveillance testing.The values of the testing parameters can then bequalitatively compared to expected values at post accidentengine loads. In making this comparison it is necessary toconsider the engine parameters as interrelated indicators ofremaining DG capacity, rather than independent indicators.The important engine parameters to be considered in makingthis comparison include, fuel rack position, scavenging airpressure, exhaust temperature and pressure, engine output,jacket water temperature, and lube oil temperature. Withthe DG operating at or near continuous rating and theobserved values of the above parameters less than expectedpost accident values, a qualitative extrapolation whichshows the DG is capable of accepting post accident loads canbe made without requiring detrimental testing.

(continued)



BASES


A load band is provided to avoid routine overloading of theDG. Routine overloading may result in more frequentteardown inspections in accordance with vendorrecommendations in order to maintain DG OPERABILITY.

The 24 month Frequency takes into consideration plantconditions required to perform the Surveillance; and isintended to be consistent with expected fuel cycle lengths.

This Surveillance has been modified by three Notes. Note 1states that momentary transients due to changing bus loadsdo not invalidate this test. Similarly, momentary powerfactor transients above the limit do not invalidate thetest. Note 2 ensures that the DG is tested under loadconditions that are as close to design basis conditions aspossible. When synchronized with offsite power, testingshould be performed at a power factor of • 0.89. This powerfactor is representative of the actual inductive loading aDG would see under design basis accident conditions. Undercertain conditions, however, Note 2 allows the Surveillanceto be conducted at a power factor other than • 0.89. Theseconditions occur when grid voltage is high, and theadditional field excitation needed to get the power factorto • 0.89 results in voltages on the emergency busses thatare too high. Under these conditions, the power factorshould be maintained as close as practicable to 0.89 whilestill maintaining acceptable voltage limits on the emergencybusses. In other circumstances, the grid voltage may be suchthat the DG excitation levels needed to obtain a powerfactor of 0.89 may not cause unacceptable voltages on theemergency busses, but the excitation levels are in excess ofthose recommended for the DG. In such cases, the powerfactor shall be maintained as close as practicable to 0.89without exceeding the DG excitation limits. To minimizetesting of the DGs, Note 3 allows a single test (instead oftwo tests, one for each unit) to satisfy the requirementsfor both units. This is allowed since the main purpose ofthe Surveillance can be met by performing the test on eitherunit. If the DG fails one of these Surveillances, the DGshould be considered inoperable on both units, unless thecause of the failure can be directly related to only oneunit.

SR 3.8.1.15

This Surveillance demonstrates that the diesel engine canrestart from a hot condition, such as subsequent to shutdownfrom normal Surveillances, and achieve the required voltageand frequency within 10 seconds. The minimum voltage andfrequency stated in the SR are those necessary to ensure theDG can accept DBA loading while maintaining acceptablevoltage and frequency levels. Stable operation at thenominal voltage and frequency values is also essential toestablishing DG OPERABILITY, but a time constraint is notimposed. This is because a typical DG will experience a

(continued)



BASES


period of voltage and frequency oscillations prior toreaching steady state operation if these oscillations arenot damped out by load application. This period may extendbeyond the 10 second acceptance criteria and could be acause for failing the SR. In lieu of a time constraint inthe SR, PBAPS will monitor and trend the actual time toreach steady state operation as a means of ensuring there isno voltage regulator or governor degradation which couldcause a DG to become inoperable. The 10 second time isderived from the requirements of the accident analysis torespond to a design basis large break LOCA. The 24 monthFrequency takes into consideration plant conditions requiredto perform the Surveillance, and is intended to beconsistent with expected fuel cycle lengths.

This SR is modified by three Notes. Note I ensures that thetest is performed with the diesel sufficiently hot. Therequirement that the diesel has operated for at least2 hours at full load conditions prior to performance ofthis Surveillance is based on manufacturer recommendationsfor achieving hot conditions. The load band is provided toavoid routine overloading of the DG. Routine overloads mayresult in more frequent teardown inspections in accordancewith vendor recommendations in order to maintain DGOPERABILITY. Momentary transients due to changing bus loadsdo not invalidate this test. Note 2 allows all DG starts tobe preceded by an engine prelube period to minimize wear andtear on the diesel during testing. To minimize testing ofthe DGs, Note 3 allows a single test (instead of two tests,one for each unit) to satisfy the requirements for bothunits. This is allowed since the main purpose of theSurveillance can be met by performing the test on eitherunit. If the DG fails one of these Surveillances, the DGshould be considered inoperable on both units, unless thecause of the failure can be directly related to only oneunit.

SR 3.8.1.16

Consistent with Regulatory Guide 1.9 (Ref. 3),paragraph C.2.2.11, this Surveillance ensures that themanual synchronization and load transfer from the DG to theoffsite source can be made and that the DG can be returned

(continued)



BASES


to ready-to-load status when offsite power is restored. Italso ensures that the auto-start logic is reset to allow theDG to reload if a subsequent loss of offsite power occurs.The DG is considered to be in ready-to-load status when theDG is at rated speed and voltage, the output breaker is openand can receive an auto-close signal on bus undervoltage,and individual load timers are reset.


This SR is modified by a Note. The reason for the Note isthat performing the Surveillance would remove a requiredoffsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. ThisSurveillance tests the applicable logic associated withUnit 2. The comparable test specified in the Unit 3Technical Specifications tests the applicable logicassociated with Unit 3. Consequently, a test must beperformed within the specified Frequency for each unit. Asthe Surveillance represents separate tests, the Notespecifying the restriction for not performing the test whilethe unit is in MODE 1, 2, or 3 does not have applicabilityto Unit 3. The Note only applies to Unit 2, thus the Unit 2Surveillances shall not be performed with Unit 2 in MODE 1,2, or 3.. Credit may be taken for unplanned events thatsatisfy this SR.

SR 3.8.1.17

Consistent with Regulatory Guide 1.9 (Ref 3),paragraph C.2*2.13, demonstration of the test mode overrideensures that the DG availability under accident conditionsis not compromised as the result of testing. Interlocks tothe LOCA sensing circuits cause the DG to automaticallyreset to ready-to-load operation if a Unit 2 ECCS initiationsignal is received during operation in the test mode whilesynchronized to either Unit 2 or a Unit 3 4 kV emergencybus. Ready-to-load operation is defined as the DG runningat rated speed and voltage with the DG output breaker open.

(continued)



BASES


The requirement to automatically energize the emergencyloads with offsite power ensures that the emergency loadswill connect to an offsite source. This is performed byensuring that the affected 4 kV bus remains energizedfollowing a simulated LOCA trip of the DG output breaker,and ensuring 4kV and ECCS logic performs as designed toconnect all emergency loads to an offsite source. Therequirement for 4kV bus loading is covered by overlappingSRs specified in Specification 3.8.1, "AC Sources-Operating"and 3.3.5.1 "ECCS Instrumentation". In lieu of actualdemonstration of connection and loading of loads, testingthat adequately shows the capability of the emergency loadsto perform these functions is acceptable. This testing mayinclude any series of sequential, overlapping, or totalsteps so that the entire connection and loading is verified.

The 24 month Frequency takes into consideration plantconditions required to perform the Surveillance and isintended to be consistent with expected fuel cycle length.

To minimize testing of the DGs, the Note allows a singletest (instead of two tests, one for each unit) to satisfythe requirements for both units. This is allowed since themain purpose of the Surveillance can be met by performingthe test on either unit. If the DG fails one of theseSurveillances, the DG should be considered inoperable onboth units, unless the cause of the failure can be directlyrelated to only one unit.

SR 3.8.1.18

Under accident and loss of offsite power conditions, loadsare sequentially connected to the bus by individual loadtimers. The sequencing logic controls the permissive andstarting signals to motor breakers to prevent overloading ofthe DGs due to high motor starting currents. The 10% loadsequence time interval tolerance ensures that sufficienttime exists for the DG to restore frequency and voltageprior to applying the next load and that safety analysisassumptions regarding ESF equipment time delays are notviolated. Reference 10 provides a summary of the automaticloading of emergency buses.

(continued)



BASES


This SR is modified by two Notes. The reason for Note I isto minimize wear and tear on the DGs during testing. Forthe purpose of this testing, the DGs must be started fromstandby conditions, that is, with the engine coolant and oilbeing continuously circulated and temperature maintainedconsistent with manufacturer recommendations. The reasonfor Note 2 is that performing the Surveillance would removea required offsite circuit from service, perturb theelectrical distribution system, and challenge safetysystems. This Surveillance tests the applicable logicassociated with Unit 2. The comparable test specified inthe Unit 3 Technical Specifications tests the applicablelogic associated with Unit 3. Consequently, a test must beperformed within the specified Frequency for each unit. Asthe Surveillance represents separate tests, the Notespecifying the restriction for not performing the test whilethe unit is in MODE 1, 2, or 3 does not have applicabilityto Unit 3. The Note only applies to Unit 2, thus the Unit 2Surveillances shall not be performed with Unit 2 in MODE 1,2, or 3. Credit may be taken for unplanned events thatsatisfy this SR.

SR 3.8.1.20

This Surveillance demonstrates that the DG startingindependence has not been compromised. Also, thisSurveillance demonstrates that each engine can achieveproper speed within the specified time when the DGs arestarted simultaneously.

The minimum voltage and frequency stated in the SR are thosenecessary to ensure the DG can accept DBA loading whilemaintaining acceptable voltage and frequency levels. Stableoperation at the nominal voltage and frequency values isalso essential to establishing DG OPERABILITY, but a timeconstraint is not imposed. This is because a typical DGwill experience a period of voltage and frequencyoscillations prior to reaching steady state operation ifthese oscillations are not damped out by load application.This period may extend beyond the 10 second acceptancecriteria and could be a cause for failing the SR. In lieuof a time constraint in the SR, PBAPS will monitor and trendthe actual time to reach steady state operation as a meansof ensuring there is no voltage regulator or governordegradation which could cause a DG to become inoperable.

(continued)



BASES



This SR is modified by a Note. The reason for the Note isthat performing the Surveillance would remove a requiredoffsite circuit from service, perturb the electricaldistribution system, and challenge safety systems. ThisSurveillance tests the applicable logic associated withUnit 2. The comparable test specified in the Unit 3Technical Specifications tests the applicable logicassociated with Unit 3. Consequently, a test must beperformed within the specified Frequency for each unit. Asthe Surveillance represents separate tests, the Notespecifying the restriction for not performing the test whilethe unit is in MODE 1, 2, or 3 does not have applicabilityto Unit 3. The Note only applies to Unit 2, thus the Unit 2Surveillances shall not be performed with Unit 2 in MODE 1,2, or 3. Credit may be taken for unplanned events thatsatisfy this SR.

SR 3.8.1.19

In the event of a DBA coincident with a loss of offsitepower, the DGs are required to supply the necessary power toESF systems so that the fuel, RCS, and containment designlimits are not exceeded.

This Surveillance demonstrates DG operation, as discussed inthe Bases for SR 3.8.1.11, during a loss of offsite poweractuation test signal in conjunction with an ECCS initiationsignal. In lieu of actual demonstration of connection andloading of loads, testing that adequately shows thecapability of the DG system to perform these functions isacceptable. This testing may include any series ofsequential, overlapping, or total steps so that the entireconnection and loading sequence is verified.

The Frequency of 24 months takes into consideration plantconditions required to perform the Surveillance and isintended to be consistent with an expected fuel cycle lengthof 24 months.

(continued



BASES


The 10 year Frequency is consistent with the recommendationsof Regulatory Guide 1.108 (Ref. 8). This SR is modified bytwo Notes. The reason for Note I is to minimize wear on theDG during testing. For the purpose of this testing, the DGsmust be started from standby conditions, that is, with theengine coolant and oil continuously circulated andtemperature maintained consistent with manufacturerrecommendations. To minimize testing of the DGs, Note 2allows a single test (instead of two tests, one for eachunit) to satisfy the requirements for both units. This isallowed since the main purpose of the Surveillance can bemet by performing the test on either unit. If a DG failsone of these Surveillances, a DG should be consideredinoperable on both units, unless the cause of the failurecan be directly related to only one unit.

SR 3.8.1.21

With the exception of this Surveillance, all otherSurveillances of this Specification (SR 3.8.1.1 throughSR 3.8.1.20) are applied only to the Unit 2 AC sources.This Surveillance is provided to direct that the appropriateSurveillances for the required Unit 3 AC sources aregoverned by the applicable Unit 3 Technical Specifications.Performance of the applicable Unit 3 Surveillances willsatisfy Unit 3 requirements, as well as satisfying thisUnit 2 Surveillance Requirement. Six exceptions are notedto the Unit 3 SRs of LCO 3.8.1. SR 3.8.1.8 is excepted whenonly one Unit 3 offsite circuit is required by the Unit 2Specification, since there is not a second circuit totransfer to. SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17,SR 3.8.1.18 (ECCS load block requirements only), andSR 3.8.1.19 are excepted since these SRs test the Unit 3ECCS initiation signal, which is not needed for the ACsources to be OPERABLE on Unit 2.


As Noted, if Unit 3 is in MODE 4 or 5, or moving irradiatedfuel assemblies in the secondary containment, the Note toUnit 3 SR 3.8.2.1 is applicable. This ensures that a Unit 2SR will not require a Unit 3 SR to be performed, when the

(continued)



BASES


SR 3.8.1.21 (continued)

Unit 3 Technical Specifications exempts performance of aUnit 3 SR (However, as stated in the Unit 3 SR 3.8.2.1 Note,while performance of an SR is exempted, the SR still must bemet).

REFERENCES I.-

2.

3.

4.

5.

6.

7.

8.

9.

10.

UFSAR, Sections 1.5 and 8.4.2.

UFSAR, Sections 8.3 and 8.4.

Regulatory Guide 1.9, July 1993.

UFSAR, Chapter 14.

Generic Letter 84-15.

Regulatory Guide 1.93, December

UFSAR, Section 1.5.1.

Regulatory Guide 1.108, August 1

Regulatory Guide 1.137, October

UFSAR, Section 8.5.

1974.

977.

1979.


AC Sources-ShutdownB 3.8.2


B 3.8.2 AC Sources--Shutdown

BASES

BACKGROUND A description of the AC sources is provided in the Bases forLCO 3.8.1, "AC Sources-Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4SAFETY ANALYSES and 5 and during movement of irradiated fuel assemblies in

secondary containment ensures that:

a. The facility can be maintained in the shutdown orrefueling condition for extended periods;

b. Sufficient instrumentation and control capability isavailable for monitoring and maintaining the unitstatus; and

c. Adequate AC electrical power is provided to mitigateevents postulated during shutdown, such as aninadvertent draindown of the vessel or a fuel handlingaccident.

In general, when the unit is shut down the TechnicalSpecifications requirements ensure that the unit has thecapability to mitigate the consequences of postulatedaccidents. However, assuming a single failure andconcurrent loss of all offsite or loss of all onsite poweris not required. The rationale for this is based on thefact that many Design Basis Accidents (DBAs) that areanalyzed in MODES 1, 2, and 3 have no specific analyses inMODES 4 and 5. Worst case bounding events are deemed notcredible in MODES 4 and 5 because the energy containedwithin the reactor pressure boundary, reactor coolanttemperature and pressure, and corresponding stresses resultin the probabilities of occurrences significantly reduced oreliminated, and minimal consequences. These deviations fromDBA analysis assumptions and design requirements duringshutdown conditions are allowed by the LCO for requiredsystems.

During MODES 1, 2, and 3, various deviations from theanalysis assumptions and design requirements are allowedwithin the ACTIONS. This allowance is in recognition that

(continued)



BASES


(continued)

certain testing and maintenance activities must beconducted, provided an acceptable level of risk is notexceeded. During MODES 4 and 5, performance of asignificant number of required testing and maintenanceactivities is also required. In MODES 4 and 5, theactivities are generally planned and administrativelycontrolled. Relaxations from typical MODES 1, 2, and 3 LCOrequirements are acceptable during shutdown MODES, based on:

a. The fact that time in an outage is limited. This is arisk prudent goal as well as a utility economicconsideration.

b. Requiring appropriate compensatory measures forcertain conditions. These may include administrativecontrols, reliance on systems that do not necessarilymeet typical design requirements applied to systemscredited in operation MODE analyses, or both.

c. Prudent utility consideration of the risk associatedwith multiple activities that could affect multiplesystems.

d. Maintaining, to the extent practical, the ability toperform required functions (even if not meetingMODES 1, 2, and 3 OPERABILITY requirements) withsystems assumed to function during an event.

In the event of an accident during shutdown, this LCOensures the capability of supporting systems necessary foravoiding immediate difficulty, assuming either a loss of alloffsite power or a loss of all onsite (diesel generator(DG)) power.

The AC sources satisfy Criterion 3 of the NRC PolicyStatement.

LCO One offsite circuit supplying the Unit 2 onsite Class IEpower distribution subsystem(s) of LCO 3.8.8, "DistributionSystems-Shutdown," ensures that all required Unit 2 poweredloads are powered from offsite power. Two OPERABLE DGs,associated with the Unit 2 onsite Class IE powerdistribution subsystem(s) required OPERABLE by LCO 3.8.8,ensures that a diverse power source is available forproviding electrical power support assuming a loss of the

(continued)



BASES

LCO(continued)

offsite circuit. In addition, some equipment that may berequired by Unit 2 is powered from Unit 3 sources (e.g.,Standby Gas Treatment (SGT) System). Therefore, onequalified circuit between the offsite transmission networkand the Unit 3 onsite Class 1E AC electrical powerdistribution subsystem(s), and one DG (not necessarily adifferent DG than those being used to meet LCO 3.8.2.brequirements) capable of supplying power to one of therequired Unit 3 subsystems of each of the requiredcomponents must also be OPERABLE. Together, OPERABILITY ofthe required offsite circuit(s) and required DG(s) ensuresthe availability of sufficient AC sources to operate theplant in a safe manner and to mitigate the consequences ofpostulated events during shutdown (e.g., fuel handlingaccidents and reactor vessel draindown). Automaticinitiation of the required DG during shutdown conditions isspecified in LCO 3.3.5.1, ECCS Instrumentation, and LCO3.3.8.1, LOP Instrumentation.

The qualified Unit 2 offsite circuit must be capable ofmaintaining rated frequency and voltage while connected tothe respective Unit 2 4 kV emergency bus(es), and ofaccepting required loads during an accident. Qualifiedoffsite circuits are those that are described in the UFSAR,Technical Specification Bases Section 3.8.1 and are part ofthe licensing basis for the unit. A Unit 2 offsite circuitconsists of the incoming breaker and disconnect to thestartup and emergency auxiliary transformer, the respectivecircuit path to the emergency auxiliary transformer, and thecircuit path to the Unit 2 4 kV emergency buses required byLCO 3.8..8, including feeder breakers to the required Unit 24 kV emergency buses. A qualified Unit 3 offsite circuit'srequirements are the same as the Unit 2 circuit'srequirements, except that the circuit path, including thefeeder breakers, is to the Unit 3 4 kV emergency busesrequired to be OPERABLE by LCO 3.8.8.

The required DGs must be capable of starting, acceleratingto rated speed and voltage, and connecting to theirrespective Unit 2 emergency bus on detection of busundervoltage. This sequence must be accomplished within10 seconds. Each DG must also be capable of acceptingrequired loads within the assumed loading sequenceintervals, and must continue to operate until offsite powercan be restored to the 4 kV emergency buses. Thesecapabilities are required to be met from a variety ofinitial conditions such as DG in standby with engine hot andDG in standby with engine at ambient conditions. Additional

(continued)



BASES

LCO(continued)

DG capabilities must be demonstrated to meet requiredSurveillances, e.g., capability of the DG to revert tostandby status on an ECCS signal while operating in paralleltest mode. Proper sequencing of loads is a requiredfunction for DG OPERABILITY. The necessary portions of theEmergency Service Water System are also required to provideappropriate cooling to each required DG.

The OPERABILITY requirements for the DG capable of supplyingpower to the Unit 3 powered equipment are the same asdescribed above, except that the required DG must be capableof connecting to its respective Unit 3 4 kV emergency bus.(In addition, the Unit 3 ECCS initiation logic SRs are notapplicable, as described in SR 3.8.2.2 Bases.)

It is acceptable for 4 kV emergency buses to be cross tiedduring shutdown conditions, permitting a single offsitepower circuit to supply all required buses. No automatictransfer capability is required for offsite circuits to beconsidered OPERABLE.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 4 and 5and during movement of irradiated fuel assemblies in thesecondary containment to provide assurance that:

a. Systems providing adequate coolant inventory makeupare available for the irradiated fuel assemblies inthe core in case of an inadvertent draindown of thereactor vessel;

b. Systems needed to mitigate a fuel handling accidentare available;

c. Systems necessary to mitigate the effects of eventsthat can lead to core damage during shutdown areavailable; and

d. Instrumentation and control capability is availablefor monitoring and maintaining the unit in a coldshutdown condition or refueling condition.

AC power requirements for MODES 1, 2, and 3 are covered inLCO 3.8.1.

(continued)



BASES (continued)

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However,since irradiated fuel assembly movement can occur in MODE 1,2, or 3, the ACTIONS have been modified by a Note statingthat LCO 3.0.3 is not applicable. If moving irradiated fuelassemblies while in MODE 4 or 5, LCO 3.0.3 would not specifyany action. If moving irradiated fuel assemblies while inMODE 1, 2, or 3, the fuel movement is independent of reactoroperations. Therefore, in either case, inability to suspendmovement of irradiated fuel assemblies would not besufficient reason to require a reactor shutdown.

A.1 and B.1

With one or more required offsite circuits inoperable, orwith one DG inoperable, the remaining required sources maybe capable of supporting sufficient required features (e.g.,system, subsystem, division, component, or device) to allowcontinuation of CORE ALTERATIONS, fuel movement, andoperations with a potential for draining the reactor vessel.For example, if two or more 4 kV emergency buses arerequired per LCO 3.8.8, one 4 kV emergency bus with offsitepower available may be capable of supplying sufficientrequired features. By the allowance of the option todeclare required features inoperable that are not poweredfrom offsite power (Required Action A.1) or capable of beingpowered by the required DG (Required Action B.I),appropriate restrictions can be implemented in accordancewith the affected feature(s) LCOs' ACTIONS. Requiredfeatures remaining powered from a qualified offsite powercircuit, even if that circuit is considered inoperablebecause it is not powering other required features, are notdeclared inoperable by this Required Action. If a single DGis credited with meeting both LCO 3.8.2.d and one of the DGrequirements of LCO 3.8.2.b, then the required featuresremaining capable of being powered by the DG are notdeclared inoperable by this Required Action, even if the DGis considered inoperable because it is not capable ofpowering other required features.

A.2.1, A.2.2. A.2.3, A.2.4. B.2.1. B.2.2. B.2.3, B.2.4. C.1,C,2. C.3. and C.4

With an offsite circuit not available to all required 4 kVemergency buses or one required DG inoperable, the optionstill exists to declare all required features inoperable

(continued)



BASES

ACTIONS A.2.1, A.2.2, A.2.3. A.2.4. B.2.1. B.2.2. B.2.3, B.2.4, C.l,C.2. C.3. and C.4 (continued)

(per Required Actions A.1 and B.1). Since this option mayinvolve undesired administrative efforts, the allowance forsufficiently conservative actions is made. With two or morerequired DGs inoperable, the minimum required diversity ofAC power sources may not be available. It is, therefore,required to suspend CORE ALTERATIONS, movement of irradiatedfuel assemblies in the secondary containment, and activitiesthat could result in inadvertent draining of the reactorvessel.

Suspension of these activities shall not preclude completionof actions to establish a safe conservative condition.These actions minimize the probability of the occurrence ofpostulated events. It is further required to immediatelyinitiate action to restore the required AC sources and tocontinue this action until restoration is accomplished inorder to provide the necessary AC power to the plant safetysystems.

The Completion Time of immediately is consistent with therequired times for actions requiring prompt attention. Therestoration of the required AC electrical power sourcesshould be completed as quickly as possible in order tominimize the time during which the plant safety systems maybe without sufficient power.

Pursuant to LCO 3.0.6, the Distribution System ACTIONS wouldnot be entered even if all AC sources to it are inoperable,resulting in de-energization. Therefore, the RequiredActions of Condition A have been modified by a Note toindicate that when Condition A is entered with no AC powerto any required 4 kV emergency bus, ACTIONS for LCO 3.8.8must be immediately entered. This Note allows Condition Ato provide requirements for the loss of the offsite circuitwhether or not a required bus is de-energized. LCO 3.8.8provides the appropriate restrictions for the situationinvolving a de-energized bus.


SR 3.8.2.1 requires the SRs from LCO 3.8.1 that arenecessary for ensuring the OPERABILITY of the Unit 2 ACsources in other than MODES 1, 2, and 3. SR 3.8.1.8 is not

(continued)


AC Sources- ShutdownB 3.8.2

BASES


required to be met since only one offslte circuit isrequired to be OPERABLE. SR 3.8.1.17 is not required to bemet because the required OPERABLE DG(s) is not required toundergo periods of being synchronized to the offsitecircuit. SR 3.8.1.20 is excepted because startingindependence is not required with the DG(s) that is notrequired to be OPERABLE. Refer to the corresponding Basesfor LCO 3.8.1 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note isto preclude requiring the OPERABLE DG(s) from beingparalleled with the offsite power network or otherwiserendered inoperable during the performance of SRs, and topreclude de-energizing a required 4 kV emergency bus ordisconnecting a required offsite circuit during performanceof SRs. With limited AC sources available, a single eventcould compromise both the required circuit and the DG. Itis the intent that these SRs must still be capable of beingmet, but actual performance is not required during periodswhen the DG and offsite circuit are required to be OPERABLE

This SR is modified by a second Note. The reason for theNote is to preclude requiring the automatic functions of theDG(s) on an ECCS initiation to be functional during periodswhen ECCS are not required. Periods in which ECCS are notrequired are specified in LCO 3.5.2, IECCS - Shutdown".

SR 3.8.2.2

This Surveillance is provided to direct that the appropriateSurveillances for the required Unit 3 AC sources aregoverned by the Unit 3 Technical Specifications.Performance of the applicable Unit 3 Surveillances willsatisfy Unit 3 requirements, as well as satisfying thisUnit 2 Surveillance Requirement. Seven exceptions are notedto the Unit 3 SRs of LCO 3.8.1. SR 3.8.1.8 is excepted whenonly one Unit 3 offsite circuit is required by the Unit 2Specification, since there is not a second circuit totransfer to. SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.17,SR 3.8.1.18 (ECCS load block requirements only), andSR 3.8.1.19 are excepted since these SRs test the Unit 3ECCS initiation signal, which is not needed for the ACsources to be OPERABLE on Unit 2. SR 3.8.1.20 is exceptedsince starting independence is not required with the DG(s)that is not required to be OPERABLE. W

(continued)

PBAPS UNIT 2 B 3.8-46 Revision No. 16Amendment No. 221

AC Sources- ShutdownB 3.8.2

BASES


S..2.2 (continued)


As Noted, if Unit 3 is not in MODE 1, 2, or 3, the Note toUnit 3 SR 3.8.2.1 is applicable. This ensures that a Unit 2SR will not require a Unit 3 SR to be performed, when theUnit 3 Technical Specifications exempts performance of aUnit 3 SR or when Unit 3 is defueled. (However, as statedin the Unit 3 SR 3.8.2.1 Note, while performance of an SR isexempted, the SR still must be met).

REFERENCES None.

Amendment No. 221Revision No. 16PBAPS UNIT 2 B 3.8-47

Diesel Fuel Oil, Lube Oil, and Starting AirB 3.8.3


B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES

BACKGROUND Each of the four diesel generators (DGs) is provided with anassociated storage tank which collectively have a fuel oilcapacity sufficient to operate all four DGs for a period of7 days while the DG is supplying maximum post loss ofcoolant accident (LOCA) load demand discussed in UFSAR,Section 8.5.2 (Ref. 1). The maximum load demand iscalculated using the time dependent loading of each DG andthe assumption that all four DGs are available. This onsitefuel oil capacity is sufficient to operate the DGs forlonger than the time to replenish the onsite supply fromoutside sources. Post accident electrical loading and fuelconsumption is not equally shared among the DGs. Therefore,it may be necessary to transfer post accident loads betweenDGs or to transfer fuel oil between storage tanks to achieve7 days of post accident operation for all four DGs. Eachstorage tank contains sufficient fuel to support theoperation of the DG with the heaviest load for greater than6 days.

Each DG is equipped with a day tank and an associated fueltransfer pump that will automatically transfer oil from afuel storage tank to the day tank of the associated DG whenactuated by a float switch in the day tank. Additionally,the capability exists to transfer fuel oil between storagetanks. Redundancy of pumps and piping precludes the failureof one pump, or the rupture of any pipe, valve, or tank toresult in the loss of more than one DG. All outside tanksand piping are located underground.

For proper operation of the standby DGs, it is necessary toensure the proper quality of the fuel oil. RegulatoryGuide 1.137 (Ref. 2) addresses the recommended fuel oilpractices as supplemented by ANSI N195 (Ref. 3). The fueloil properties governed by these SRs are the water andsediment content, the kinematic viscosity, specific gravity(or API gravity), and impurity level.

(continued)



BASES


The DG lubrication system is designed to provide sufficientlubrication to permit proper operation of its associated DGunder all loading conditions. The system is required tocirculate the lube oil to the diesel engine working surfacesand to remove excess heat generated by friction duringoperation. Each engine oil sump and associated lube oilstorage tank contain an inventory capable of supporting aminimum of 7 days of operation. Each lube oil sump utilizesa mechanical float-type level controller to automaticallymaintain the sump at the "full level running" level viagravity feed from the associated lube oil storage tank.Onsite storage of lube oil also helps ensure a 7 day supplyis maintained. This supply is sufficient to allow theoperator to replenish lube oil from outside sources.

Each DG has an air start system that includes two air startreceivers; each with adequate capacity for five successivenormal starts on the DG without recharging the air startreceiver.


The initial conditions of Design Basis Accident (DBA) andtransient analyses in UFSAR, Chapter 8 (Ref. 4), andChapter 14 (Ref. 5), assume Engineered Safety Feature (ESF)systems are OPERABLE. The DGs are designed to providesufficient capacity, capability, redundancy, and reliabilityto ensure the availability of necessary power to ESF systemsso that fuel, Reactor Coolant System, and containment designlimits are not exceeded. These limits are discussed in moredetail in the Bases for Section 3.2, Power DistributionLimits; Section 3.5, Emergency Core Cooling Systems (ECCS)and Reactor Core Isolation Cooling (RCIC) System; andSection 3.6, Containment Systems.

Since diesel fuel oil, lube oil, and starting air subsystemsupport the operation of the standby AC power sources, theysatisfy Criterion 3 of the NRC Policy Statement.

LCO Stored diesel fuel oil is required to have sufficient supplyfor 7 days of operation at the worst case post accidenttime-dependent load profile. It is also required to meetspecific standards for quality. Additionally, sufficientlube oil supply must be available to ensure the capabilityto operate at full load for 7 days. This requirement, in

(continued)



BASES

LCO(continued)

conjunction with an ability to obtain replacement supplieswithin 7 days, supports the availability of DGs required toshut down both the Unit 2 and Unit 3 reactors and tomaintain them in a safe condition for an abnormaloperational transient or a postulated DBA in one unit withloss of offsite power. DG day tank fuel oil requirements,as well as transfer capability from the storage tank to theday tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

The starting air system is required to have a minimumcapacity for five successive DG normal starts withoutrecharging the air start receivers. Only one air startreceiver per DG is required, since each air start receiverhas the required capacity.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required toensure the availability of the required power toshut downboth the Unit 2 and Unit 3 reactors and-maintain them in asafe shutdown condition after an abnormal operationaltransient or a postulated DBA in either Unit 2 or Unit 3.Because stored diesel fuel oil, lube oil, and starting airsubsystem support LCO 3.8.1 and LCO 3.8.2, stored dieselfuel oil, lube oil, and starting air are required to bewithin limits when the associated DG is required to beOPERABLE.

ACTIONS The Actions Table is modified by a Note indicating thatseparate Condition entry is allowed for each DG. This isacceptable, since the Required Actions for each Conditionprovide appropriate compensatory actions for each inoperableDG subsystem. Complying with the Required Actions for oneinoperable DG subsystem may allow for continued operation,and subsequent inoperable DG subsystem(s) are governed byseparate condition entry and application of associatedRequired Actions.

(continued)



BASES

ACTIONS A.1(continued) With fuel oil level < 31,000 gal in a storage tank (which

includes margin for the unusable volume of oil), the 7 dayfuel oil supply for a DG is not available. However, theCondition is restricted to fuel oil level reductions thatmaintain at least a 6 day supply. These circumstances maybe caused by events such as:

a. Full load operation required for an inadvertent startwhile at minimum required level; or

b. Feed and bleed operations that may be necessitated byincreasing particulate levels or any number of otheroil quality degradations.

This restriction allows sufficient time for obtaining therequisite replacement volume and performing the analysesrequired prior to addition of the fuel oil to the tank. Aperiod of 48 hours is considered sufficient to completerestoration of the required level prior to declaring the DGinoperable. This period is acceptable based on theremaining capacity (> 6 days), the fact that procedures willbe initiated to obtain replenishment, and the lowprobability of an event during this brief period.

B.1

With lube oil inventory < 350 gal, sufficient lube oil tosupport 7 days of continuous DG operation at full loadconditions may not be available. However, the Condition isrestricted to lube oil volume reductions that maintain atleast a 6 day supply. This restriction allows sufficienttime for obtaining the requisite replacement volume. Aperiod of 48 hours is considered sufficient to completerestoration of the required volume prior to declaring the DGinoperable. This period is acceptable based on theremaining capacity (> 6 days), the low rate of usage, thefact that procedures will be initiated to obtainreplenishment, and the low probability of an event duringthis brief period.

(continued)



BASES


This Condition is entered as a result of a failure to meetthe acceptance criterion for particulates. Normally,trending of particulate levels allows sufficient time tocorrect high particulate levels prior to reaching the limitof acceptability. Poor sample procedures (bottom sampling),contaminated sampling equipment, and errors in laboratoryanalysis can produce failures that do not follow a trend.Since the presence of particulates does not mean failure ofthe fuel oil to burn properly in the diesel engine, sinceparticulate concentration is unlikely to changesignificantly between Surveillance Frequency intervals, andsince proper engine performance has been recentlydemonstrated (within 31 days), it is prudent to allow abrief period prior to declaring the associated DGinoperable. The 7 day Completion Time allows for furtherevaluation, resampling, and re-analysis of the DG fuel oil.

D.1

With the new fuel oil properties defined in the Bases forSR 3.8.3.3 not within the required limits, a period of30 days is allowed for restoring the stored fuel oilproperties. This period provides sufficient time to testthe stored fuel oil to determine that the new fuel oil, whenmixed with previously stored fuel oil, remains acceptable,or to restore the stored fuel oil properties. Thisrestoration may involve feed and bleed procedures,filtering, or combination of these procedures. Even if a DGstart and load was required during this time interval andthe fuel oil properties were outside limits, there is highlikelihood that the DG would still be capable of performingits intended function.

E.1

With required starting air receiver pressure < 225 psig,sufficient capacity for five successive DG normal startsdoes not exist. However, as long as the receiver pressureis > 150 psig, there is adequate capacity for at least onestart attempt, and the DG can be considered OPERABLE while

(continued)



BASES

ACTIONS E.1 (continued)

the air receiver pressure is restored to the required limit.A period of 48 hours is considered sufficient to completerestoration to the required pressure prior to declaring theDG inoperable. This period is acceptable based on theremaining air start capacity, the fact that most DG startsare accomplished on the first attempt, and the lowprobability of an event during this brief period.

F.1

With a Required Action and associated Completion Time ofCondition A, B, C, D, or E not met, or the stored dieselfuel oil, lube oil, or starting air subsystem not withinlimits for reasons other than addressed by Conditions Athrough E, the associated DG may be incapable of performingits intended function and must be immediately declaredinoperable.


This SR provides verification that there is an adequateuseable inventory of fuel oil in the storage tanks tosupport each DG's operation of all four DGs for 7 days atthe worst case post accident time-dependent load profile.The 7 day period is sufficient time to place both Unit 2 andUnit 3 in a safe shutdown condition and to bring in-replenishment fuel from an offsite location.

The 31 day Frequency is adequate to ensure that a sufficientsupply of fuel oil is available, since low level alarms areprovided and unit operators would be aware of any large usesof fuel oil during this period.

SR 3.8.3.2

This Surveillance ensures that sufficient lubricating oilinventory (combined inventory in the DG lube oil sump, lubeoil storage tank, and in the warehouse) is available tosupport at least 7 days of full load operation for each DG.The 350 gal requirement is conservative with respect to theDG manufacturer's consumption values for the run time of theDG. Implicit in this SR is the requirement to verify the

(continued)



BASES


capability to transfer the lube oil from its storagelocation to the DG to maintain adequate inventory for 7 daysof full load operation without the level reaching themanufacturer's recommended minimum level.

A 31 day Frequency is adequate to ensure that a sufficientlube oil supply is onsite, since DG starts and run time areclosely monitored by the plant staff.

SR 3.8.3.3

The tests of new fuel oil prior to addition to the storagetanks are a means of determining whether new fuel oil is ofthe appropriate grade and has not been contaminated withsubstances that would have an immediate detrimental impacton diesel engine combustion. If results from these testsare within acceptable limits, the fuel oil may be added tothe storage tanks without concern for contaminating theentire volume of fuel oil in the storage tanks. These testsare to be conducted prior to adding the new fuel to thestorage tank(s), but in no case is the time between thesample (and corresponding results) of new fuel and additionof new fuel oil to the storage tanks to exceed 31 days. Thetests, limits, and applicable ASTM Standards are as follows:

a. Sample the new fuel oil in accordance with ASTMD4057-81 (Ref. 6);

b. Verify in accordance with the tests specified in ASTMD975-81 (Ref. 6) as discussed in Reference 7 that thesample has a kinematic viscosity at 40"C of 2 1.9centistokes and s 4.1 centistokes (if specific gravitywas not determined by comparison with the supplier'scertification), and a flash point of 2 125"F;

c. Verify in accordance with tests specified in ASTMD1298-80 (Ref. 6) as discussed in Reference 7 that thesample has an absolute specific gravity at 60/60°F ofz0.83 and : 0.89, or an absolute specific gravity ofwithin 0.0016 at 60/60"F when compared to thesupplier's certificate, or an API gravity at 60°F of; 27" and r 39", or an API gravity of within 0.3" at601F when compared to the supplier's certification;and

(continued)



BASES


d. Verify that the new fuel oil has a clear and brightappearance with proper color when tested in accordancewith ASTM D4176-82 (Ref. 6) as discussed in Reference7; or verify, in accordance with ASTM D975-81 (Ref.6), that the sample has a water and sediment content< 0.05 volume percent when dyes have beenintentionally added to fuel oil (for example due tosulfur content).

Failure to meet any of the above limits is cause forrejecting the new fuel oil, but does not represent a failureto meet the LCO concern since the fuel oil is not added tothe storage tanks.

Following the initial new fuel oil sample, the fuel oil isanalyzed to establish that the other properties specified inTable 1 of ASTM D975-81 (Ref. 6) are met for new fuel oilwhen tested in accordance with ASTM D975-81 (Ref. 6) asdiscussed in Reference 7, except that the analysis forsulfur may be performed in accordance with ASTM D1552-79(Ref. 6) or ASTM D2622-82 (Ref. 6) as discussed inReference 7. These additional analyses are required bySpecification 5.5.9, "Diesel Fuel Oil Testing Program," tobe performed within 31 days following sampling and addition.This 31 day requirement is intended to assure that: 1) thenew fuel oil sample taken is no more than 31 days old at thetime of adding the new fuel oil to the DG storage tank, and2) the results of the new fuel oil sample are obtainedwithin 31 days after addition of the new fuel oil to the DGstorage tank. The 31 day period is acceptable because thefuel oil properties of interest, even if they were notwithin stated limits, would not have an immediate effect onDG operation. This Surveillance ensures the availability ofhigh quality fuel oil for the DGs.

Fuel oil degradation during long term storage shows up as anincrease in particulate, mostly due to oxidation. Thepresence of particulate does not mean that the fuel oil willnot burn properly in a diesel engine. The particulate cancause fouling of filters and fuel oil injection equipment,however, which can cause engine failure. The fuel oilproperties which can affect diesel generator performance(flash point, cetane number, viscosity, cloud point) do notchange during storage. If these properties are withinspecification when the fuel is placed in storage, they willremain within specification unless other non-specificationpetroleum products are added to the storage tanks. Theaddition of non-specification petroleum products isprecluded by above described surveillance test program.

Particulate concentrations should be determined inaccordance with ASTM D2276-78 (Ref. 6), Method A, asdiscussed in Reference 7 except that the filters specified

(continued)



BASES


in ASTM D2276-78, (Sections 3.1.6 and 3.1.7) may have anominal pore size up to three microns. This method involvesa gravimetric determination of total particulateconcentration in the fuel oil and has a limit of 10 mg/l.It is acceptable to obtain a field sample for subsequentlaboratory testing in lieu of field testing. For the PeachBottom Atomic Power Station design in which the total volumeof stored fuel oil is contained in four interconnectedtanks, each tank must be considered and tested separately.

The Frequency of this test takes into consideration fuel oildegradation trends that indicate that particulateconcentration is unlikely to change significantly betweenFrequency intervals.

SR 3.8.3.4

This Surveillance ensures that, without the aid oftherefill compressor, sufficient air start capacity for each DGis available. The system design requirements provide for aminimum of five normal engine starts without recharging.The pressure specified in this SR is intended to reflect thelowest value at which the five starts can be accomplished.

The 31 day Frequency takes into account the capacity,capability, redundancy, and diversity of the AC sources andother indications available in the control room, includingalarms, to alert the operator to below normal air startpressure.

SR 3.8.3.5

Microbiological fouling is a major cause of fuel oildegradation. There are numerous bacteria that can grow infuel oil and cause fouling, but all must have a waterenvironment in order to survive. Removal of water from thefuel storage tanks once every 31 days eliminates thenecessary environment for bacterial survival. This is themost effective means of controlling microbiological fouling.In addition, it eliminates the potential for waterentrainment in the fuel oil during DG operation. Water maycome from any of several sources, including condensation,ground water, rain water, contaminated fuel oil, and from

(continued)



BASES


breakdown of the fuel oil by bacteria. Frequent checkingfor and removal of accumulated water minimizes fouling andprovides data regarding the watertight integrity of the fueloil system. The Surveillance Frequencies are consistentwith Regulatory Guide 1.137 (Ref. 2). This SR is forpreventive maintenance. The presence of water does notnecessarily represent failure of this SR, provided theaccumulated water is removed during performance of theSurveillance.


2. Regulatory Guide 1.137, Revision 1.

3. ANSI N195, 1976.



6. ASTM Standards: D4057-81; D975-81; D1298-80;D4176-82; D1552-79; D2622-82; and D2276-78.

7. Letter from G. A. Hunger (PECO Energy) to USNRCDocument Control Desk; Peach Bottom Atomic PowerStation Units 2 and 3, Supplement 7 to TSCR 93-16,Conversion to Improved Technical Specifications; datedMay 24, 1995.


DC Sources-OperatingB 3.8.4


B 3.8.4 DC Sources--Operating

BASES

BACKGROUND The DC electrical power system provides the AC emergencypower system with control power. It also provides a sourceof reliable, uninterruptible 125/250 VDC power and 125 VDCcontrol power and instrument power to Class IE and non-ClassIE loads during normal operation and for safe shutdown ofthe plant following any plant design basis event or accidentas documented in the UFSAR (Ref. 1), independent of AC poweravailability. The DC Electrical Power System meets theintent of the Proposed IEEE Criteria for Class IE ElectricalSystems for Nuclear Power Generating Stations (Ref. 2). TheDC electrical power system is designed to have sufficientindependence, redundancy, and testability to perform itssafety functions, assuming a single failure.

The DC power sources provide both motive and control power,and instrument power, to selected safety related equipment,as well as to the nonsafety related equipment. There aretwo independent divisions per unit, designated Division Iand Division II. Each division consists of two 125 VDCbatteries. The two 125 VDC batteries in each division areconnected in series. Each 125 VDC battery has two chargers(one normally inservice charger and one spare charger) thatare exclusively associated with that battery and cannot beinterconnected with any other 125 VDC battery. The chargersare supplied from separate 480 V motor control centers(MCCs). Each of these MCCs is connected to an independentemergency AC bus. Some of the chargers are capable of beingsupplied by Unit 3 MCCs, which receive power from a 4 kVemergency bus, via manual transfer switches. However, for arequired battery charger to be considered OPERABLE when theunit is in MODE 1, 2, or 3, it must receive power from itsassociated Unit 2 MCC. The safety related loads between the125/250 VDC subsystem are not transferable except for theAutomatic Depressurization System (ADS) valves and logiccircuits and the main steam safety/relief valves. The ADSlogic circuits and valves and the main steam safety/reliefvalves are normally fed from the Division I DC system.

(continued)



BASES

BACKGROUND During normal operation, the DC loads are powered from the(continued) battery chargers with the batteries floating on the system.

In case of loss of normal power to the battery charger, theDC loads are powered from the batteries.

The DC power distribution system is described in more detailin Bases for LCO 3.8.7, "Distribution System-Operating,"and LCO 3.8.8, "Distribution System-Shutdown."

Each battery has adequate storage capacity to carry therequired load continuously for approximately 2 hours.

Each of the unit's two DC electrical power divisions,consisting of two 125 V batteries in series, four batterychargers (two normally inservice chargers and two sparechargers), and the corresponding control equipment andinterconnecting cabling, is separately housed in aventilated room apart from its chargers and distributioncenters. Each division is separated electrically from theother division to ensure that a single failure in onedivision does not cause a failure in a redundant division.There is no sharing between redundant Class IE divisionssuch as batteries, battery chargers, or distribution panels.

The batteries for DC electrical power subsystems are sizedto produce required capacity at 80% of nameplate rating,corresponding to warranted capacity at end of life cyclesand the 100% design demand. The minimum design voltage forsizing the battery using the methodology in IEEE 485(Ref. 3) is based on a traditional 1.81 volts per cell atthe end of a 2 hour load profile. The battery terminalvoltage using 1.81 volts per cell is 105 V. Using theLOOP/LOCA load profile, the predicted value of the batteryterminals is greater than 105 VDC at the end of the profile.Many IE loads operate exclusively at the beginning of theprofile and require greater than the design minimum terminalvoltage. The analyzed voltage of the distribution panelsand the MCCs is greater than that required during theLOOP/LOCA to support the operation of the IE loads duringthe time period they are required to operate.

Each required battery charger of DC electrical powersubsystem has ample power output capacity for the steadystate operation of connected loads required during normaloperation, while at the same time maintaining its battery

(continued)


DC Sources--OperatingB 3.8.4

BASES

BACKGROUND bank fully charged. Each battery charger has sufficient(continued) capacity to restore the battery from the design minimum

charge to its fully charged state within 20 hours whilesupplying normal steady state loads following a LOCAcoincident with a loss of offsite power.

A description of the Unit 3 DC power sources is provided inthe Bases for Unit 3 LCO 3.8.4, "DC Sources--Operating."

APPLICABLE The initial conditions of Design Basis Accident (DBA) andSAFETY ANALYSES transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume

that Engineered Safety Feature (ESF) systems are OPERABLE.The DC electrical power system provides normal and emergencyDC electrical power for the DGs, emergency auxiliaries, andcontrol and switching during all MODES of operation. TheOPERABILITY of the DC subsystems is consistent with theinitial assumptions of the accident analyses and is basedupon meeting the design basis of the unit. This includesmaintaining DC sources OPERABLE during accident conditionsin the event of:

a. An assumed loss of all offsite AC power or all onsiteAC power; and

b. A worst case single failure.

The DC sources satisfy Criterion 3 of the NRC PolicyStatement.

LCO The Unit 2 Division I and Division II DC electrical powersubsystems, with each DC subsystem consisting of two 125 Vstation batteries in series, two battery chargers (one perbattery), and the corresponding control equipment andinterconnecting cabling supplying power to the associatedbus, are required to be OPERABLE to ensure the availabilityof the required power to shut down the reactor and maintainit in a safe condition after an abnormal operationaltransient or a postulated DBA. In addition, DC controlpower (which provides control power for the 4 kV loadcircuit breakers and the feeder breakers to the 4 kVemergency bus) for two of the four 4 kV emergency buses, aswell as control power for two of the diesel generators, isprovided by the Unit 3 DC electrical power subsystems.Therefore, Unit 3 Division I and Division II DC electricalpower subsystems are also required to be OPERABLE. A Unit 3

(continued)



BASES

LCO(continued)

DC electrical power subsystem OPERABILITY requirements arethe same as those required for a Unit 2 DC electrical powersubsystem, except that the Unit 3: 1) Division I DCelectrical power subsystem is allowed to consist of only the125 V battery C, an associated battery charger, and thecorresponding control equipment and interconnecting cablingsupplying 125 V power to the associated bus; and 2)Division II DC electrical power subsystem is allowed toconsist of only the 125 V battery D, an associated batterycharger, and the corresponding control equipment andinterconnecting cabling supplying 125 V power to theassociated bus. This exception is allowed only if all250 VDC loads are removed from the associated bus. Inaddition, a Unit 3 battery charger can be powered from aUnit 2 AC source, (as described in the Background section ofthe Bases for Unit 3 LCO 3.8.4, "DC Sources-Operating"),and be considered OPERABLE for the purposes of meeting thisLCO. Thus, loss of any DC electrical power subsystem doesnot prevent the minimum safety function from beingperformed.

APPLICABILITY The DC electrical powerin MODES 1, 2, and 3 toensure that:

sources are required to be OPERABLEensure safe unit operation and to


b. Adequate core cooling is provided, and containmentintegrity and other vital functions are maintained inthe event of a postulated DBA.

The DC electrical power requirements for MODES 4 and 5 areaddressed in LCO 3.8.5, "DC Sources- Shutdown."

ACTIONS A.1

Pursuant to LCO 3.0.6, the.Distribution Systems-OperatingACTIONS would not be entered even if the DC electrical powersubsystem inoperability resulted in de-energization of an ACor DC bus. Therefore, the Required Actions of Condition Aare modified by a Note to indicate that when Condition A

(continued)



BASES


results in de-energization of a Unit 2 4 kV emergency bus ora Unit 3 DC bus, Actions for LCO 3.8.7 must be immediatelyentered. This allows Condition A to provide requirementsfor the loss of a Unit 3 DC electrical power subsystem (dueto performance of SR 3.8.4.7 or SR 3.8.4.8) without regardto whether a bus is de-energized. LCO 3.8.7 provides theappropriate restriction for a de-energized bus.

If one Unit 3 DC electrical power subsystem is inoperabledue to performance of SR 3.8.4.7 or SR 3.8.4.8, theremaining DC electrical power subsystems have the capacityto support a safe shutdown and to mitigate an accidentcondition. In the case of an inoperable Unit 3 DCelectrical power subsystem, since a subsequent postulatedworst case single failure could result in the loss of safetyfunction, continued power operation should not exceed7 days. The 7 day Completion Time is based upon the Unit 3DC electrical power subsystem being inoperable due toperformance of SR 3.8.4.7 or SR 3.8.4.8. Performance ofthese two SRs will result in inoperability of the Unit 3 DCdivisional batteries since these batteries are needed forUnit 2 operation, more time is provided to restore thebatteries, if the batteries are inoperable for performanceof required Surveillances, to preclude the need for a dualunit shutdown to perform these Surveillances. The Unit 3 DCelectrical power subsystems also do not provide power to thesame type of equipment as the Unit 2 DC sources. TheCompletion Time also takes into account the capacity andcapability of the remaining DC sources.

B.1

Pursuant to LCO 3.0.6, the Distribution Systems-OperatingACTIONS would not be entered even if the DC electrical powersubsystem inoperability resulted in de-energization of an ACbus. Therefore, the Required Actions of Condition A aremodified by a Note to indicate that when Condition A resultsin de-energization of a Unit 2 4 kV emergency bus, Actionsfor LCO 3.8.7 must be immediately entered. This allowsCondition A to provide requirements for the loss of a Unit 3DC electrical power subsystem without regard to whether abus is de-energized. LCO 3.8.7 provides the appropriaterestriction for a de-energized bus.

(continued)



BASES


If one of the Unit 3 DC electrical power subsystems isinoperable for reasons other than Condition A, the remainingDC electrical power subsystems have the capacity to supporta safe shutdown and to mitigate an accident condition.Since a subsequent worst case single failure could, however,result in a loss of minimum necessary DC electricalsubsystems to mitigate a worst case accident, continuedpower operation should not exceed 12 hours. The 12 hourCompletion Time reflects a reasonable time to assess unitstatus as a function of the inoperable DC electrical powersubsystem and takes into consideration the importance of theUnit 3 DC electrical power subsystem.

C.1

Condition C represents one Unit 2 division with a loss ofability to completely respond to an event, and a potentialloss of ability to remain energized during normal operation.It is therefore imperative that the operator's attentionfocus on stabilizing the unit, minimizing the potential forcomplete loss of DC power.

If one of the Unit 2 DC electrical power subsystems isinoperable (e.g., inoperable battery/batteries, inoperablerequired battery charger/chargers, or inoperable requiredbattery charger/chargers and associated battery/batteries),the remaining DC electrical power subsystems have thecapacity to support a safe shutdown and to mitigate anaccident condition. Since a subsequent worst case singlefailure could result in the loss of minimum necessary DCelectrical subsystems to mitigate a worst case accident,continued power operation should not exceed 2 hours. The2 hour Completion Time is consistent with RegulatoryGuide 1.93 (Ref. 4) and reflects a reasonable time to assessunit status as a function of the inoperable DC electricalpower division and, if the Unit 2 DC electrical powerdivision is not restored to OPERABLE status, to prepare toinitiate an orderly and safe unit shutdown. The 2 hourlimit is also consistent with the allowed time for aninoperable Unit 2 DC Distribution System division.

(continued)



BASES

ACTIONS D.1 and D.2(continued)

If the DC electrical power subsystem cannot be restored toOPERABLE status within the required Completion Time, theunit must be brought to a MODE in which the LCO does notapply. To achieve this status, the unit must be brought toat least MODE 3 within 12 hours and to MODE 4 within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems. The Completion Timeto bring the unit to MODE 4 is consistent with the timespecified in Regulatory Guide 1.93 (Ref. 4).

E.1

Condition E corresponds to a level of degradation in the DCelectrical power subsystems that causes a required safetyfunction to be lost. When more than one DC source is lost,this results in a loss of a required function, thus theplant is in a condition outside the accident analysis.Therefore, no additional time is justified for continuedoperation. LCO 3.0.3 must be entered immediately tocommence a controlled shutdown.

SURVEILLANCE As Noted at the beginning of the SRs, SR 3.8.4.1 throughREQUIREMENTS SR 3.8.4.8 are applicable only to the Unit 2 DC electrical

power subsystems and SR 3.8.4.9 is applicable only to theUnit 3 DC electrical power subsystems.

SR 3.8.4.1

Verifying battery terminal voltage while on float charge forthe batteries helps to ensure the effectiveness of thecharging system and the ability of the batteries to performtheir intended function. Float charge is the condition inwhich the charger is supplying the continuous chargerequired to overcome the internal losses of a battery (orbattery cell) and maintain the battery (or a battery cell)in a fully charged state. The voltage requirements are

(continued)



BASES


based on the minimum cell voltage that will maintain acharged cell. This is consistent with the assumptions inthe battery sizing calculations. The SR must be performedevery 7 days, unless (as specified by the Note in theFrequency) the battery is on equalize charge or has been onequalize charge any time during the previous I day. Thisallows the routine 7 day Frequency to be extended until sucha time that the SR can be properly performed and meaningfulresults obtained. The 14 day Frequency is not modified bythe Note, thus regardless of how often the battery is placedon equalize charge, the SR must be performed every 14 days.

SR 3.8.4.2

Visual inspection to detect corrosion of the battery cellsand connections or measurement of the resistance of eachinter-cell, inter-rack, inter-tier, and terminal connection,provides an indication of physical damage or abnormaldeterioration that could potentially degrade batteryperformance.

The battery connection resistance limits are established tomaintain connection resistance as low as reasonably possibleto minimize the overall voltage drop across the battery, andthe possibility of battery damage due to heating ofconnections.

The Frequency for these inspections, which can detectconditions that can cause power losses due to resistanceheating, is 92 days. This Frequency is consideredacceptable based on operating experience related todetecting corrosion trends.

SR 3.8.4.3

Visual inspection of the battery cells, cell plates, andbattery racks provides an indication of physical damage orabnormal deterioration that could potentially degradebattery performance. The presence of physical damage ordeterioration does not necessarily represent a failure of

(continued)



BASES


this SR, provided an evaluation determines that the physicaldamage or deterioration does not affect the OPERABILITY ofthe battery (its ability to perform its design function).

The 12 month Frequency for these SRs is consistent withIEEE-450 (Ref. 5), which recommends detailed visualinspection of cell condition and rack integrity on a yearlybasis.

SR 3.8.4.4 and SR 3.8.4.5

Visual inspection and resistance measurements of inter-cell,inter-rack, inter-tier, and terminal connections provides anindication of physical damage or abnormal deterioration thatcould indicate degraded battery condition. The anti-corrosion material is used to help ensure good electricalconnections and to reduce terminal deterioration. Thevisual inspection for corrosion is not intended to requireremoval of and inspection under each terminal connection.

The removal of visible corrosion is a preventive maintenanceSR. The presence of visible corrosion does not necessarilyrepresent a failure of this SR, provided visible corrosionis removed during performance of this Surveillance.

The battery connection resistance limits are established tomaintain connection resistance as low as reasonably possibleto minimize the overall voltage drop across the battery, andthe possibility of battery damage due to heating ofconnections.

The 12 month Frequency of these SRs is consistent withIEEE-450 (Ref. 5), which recommends detailed visualinspection of cell condition and inspection of cell to celland terminal connection resistance on a yearly basis.

SR 3.8.4.6

Battery charger capability requirements are based on thedesign capacity of the chargers. The minimum chargingcapacity requirement is based on the capacity to maintainthe associated battery in its fully charged condition, and

(continued)



BASES


to restore the battery to its fully charged conditionfollowing the worst case design discharge while supplyingnormal steady state loads. The minimum required amperes andduration ensures that these requirements can be satisfied.

The Frequency is acceptable, given battery chargerreliability and the administrative controls existing toensure adequate charger performance during these 24 monthintervals. In addition, this Frequency is intended to beconsistent with expected fuel cycle lengths.

SR 3.8.4.7

A battery service test is a special test of the battery'scapability, as found, to satisfy the design requirements(battery duty cycle) of the DC Electrical Power System. Thedischarge rate and test length corresponds to the designduty cycle requirements.

The Frequency is acceptable, given the unit conditionsrequired to perform the test and the other requirementsexisting to ensure adequate battery performance during these24 month intervals. In addition, this Frequency is intendedto be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. Note I allows performanceof either a modified performance discharge test or aperformance discharge test (described in the Bases for SR3.8.4.8) in lieu of a service test once per 60 monthsprovided the test performed envelops the duty cycle of thebattery. This substitution is acceptable because as long asthe test current is greater than or equal to the actual dutycycle of the battery, SR 3.8.4.8 represents a more severetest of battery capacity than a service test. In addition,since PBAPS refueling outage cycle is 24 months, SR 3.8.4.8is performed every 48 months to ensure the 60 monthFrequency is met. Therefore, SR 3.8.4.8 is performed inlieu of SR 3.8.4.7 every second refueling outage.

(continued)

PBAPS UNIT 2 R 3-8-67 Revision No. 0


BASES


The reason for Note 2 is that performing the Surveillancewould remove a required DC electrical power subsystem fromservice, perturb the Electrical Distribution System, andchallenge safety systems. Credit may be taken for unplannedevents that satisfy the Surveillance.

SR 3.8.4.8

A battery performance discharge test is a test of theconstant current capacity of a battery, performed between 3and 30 days after an equalize charge of the battery, todetect any change in the capacity determined by theacceptance test. The test is intended to determine overallbattery degradation due to age and usage.

A battery modified performance discharge test is a simulatedduty cycle consisting of just two rates; the one minute ratepublished for the battery or the largest current load of theduty cycle, followed by the test rate employed for theperformance test, both of which envelope the duty cycle ofthe service test. Since the ampere-hours removed by a ratedone minute discharge represents a very small portion of thebattery capacity, the test rate can be changed to that forthe performance test without compromising the results of theperformance discharge test. The battery terminal voltagefor the modified performance discharge test should remaingreater than or equal to the minimum battery terminalvoltage specified in the battery performance discharge test.

A modified performance discharge test is a test of thebattery capacity and its ability to provide a high rate,short duration load (usually the highest rate of the dutycycle). This will often confirm the battery's ability tomeet the critical period of the load duty cycle, in additionto determining its percentage of rated capacity. Initialconditions for the modified performance discharge testshould be identical to those specified for a performancedischarge test.

Either the battery performance discharge test or themodified performance discharge test is acceptable forsatisfying SR 3.8.4.8; however, the discharge test may be

(continued)



BASES


used to satisfy SR 3.8.4.8 while satisfying the requirementsof SR 3.8.4.7 at the same time only if the test envelops theduty cycle of the battery.

The acceptance criteria for this Surveillance is consistentwith IEEE-450 (Ref. 5) and IEEE-485 (Ref. 3). Thesereferences recommend that the battery be replaced if itscapacity is below 80% of the manufacturer's rating. Acapacity of 80% shows that the battery rate of deteriorationis increasing, even if there is ample capacity to meet theload requirements.

The Frequency for this test is normally 60 months. If thebattery shows degradation, or if the battery has reached 85%of its expected life and capacity is < 100% of themanufacturers rating, the Surveillance Frequency is reducedto 12 months. However, if the battery shows no degradationbut has reached 85% of its expected life, the SurveillanceFrequency is only reduced to 24 months for batteries thatretain capacity z 100% of the manufacturer's rating.Degradation is indicated, according to IEEE-450 (Ref. 5),when the battery capacity drops-by more than 1]% relative toits capacity on the previous performance test or when it is10% below the manufacturer's rating. If the rate ofdischarge varies significantly from the previous dischargetest, the absolute battery capacity may changesignificantly, resulting in a capacity drop exceeding thecriteria specified above. This absolute battery capacitychange could be a result of acid concentration in the platematerial, which is not an indication of degradation.Therefore, results of tests with significant ratedifferences should be discussed with the vendor andevaluated to determine if degradation has occurred. Allthese Frequencies, with the exception of the 24 monthFrequency, are consistent with the recommendations inIEEE-450 (Ref. 5). The 24 month Frequency is acceptable,given the battery has shown no signs of degradation, theunit conditions required to perform the test and otherrequirements existing to ensure battery performance duringthese 24 month intervals. In addition, the 24 monthFrequency is intended to be consistent with expected fuelcycle lengths.

(continued)



BASES


This SR is modified by a Note. The reason for the Note isthat performing the Surveillance would remove a required DCelectrical power subsystem from service, perturb theelectrical distribution system, and challenge safetysystems. Credit may be taken for unplanned events thatsatisfy the Surveillance. The DC batteries of the otherunit are exempted from this restriction since they arerequired to be OPERABLE by both units and the Surveillancecannot be performed in the manner required by the Notewithout resulting in a dual unit shutdown.

SR 3.8.4.9

With the exception of this Surveillance, all otherSurveillances of this Specification (SR 3.8.4.1 throughSR 3.8.4.8) are applied only to the Unit 2 DC electricalpower subsystems. This Surveillance is provided to directthat the appropriate Surveillances for the required Unit 3DC electrical power subsystems are governed by the Unit 3Technical Specifications. Performance of the applicableUnit 3 Surveillances will satisfy Unit 3 requirements, aswell as satisfying this Unit 2 Surveillance Requirement.

The Frequency required by the applicable Unit 3 SR alsogoverns performance of that SR for Unit 2. As Noted, ifUnit 3 is in MODE 4 or 5, or moving irradiated fuelassemblies in the secondary containment, the Note to Unit 3SR 3.8.5.1 is applicable. This ensures that a Unit 2 SRwill not require a Unit 3 SR to be performed, when theUnit 3 Technical Specifications exempts performance of aUnit 3 SR. (However, as stated in the Unit 3 SR 3.8.5.1Note, while performance of the SR is exempted, the SR stillmust be met.)


2. "Proposed IEEE Criteria for Class 1E ElectricalSystems for Nuclear Power Generating Stations," June1969.

3. IEEE Standard 485, 1983.

(continued)



BASES

REFERENCES 4. Regulatory Guide 1.93, December 1974.(continued)



DC Sources-ShutdownB 3.8.5


B 3.8.5 DC Sources-Shutdown

BASES

BACKGROUND A description of the DC sources is provided in the Bases forLCO 3.8.4, "DC Sources-Operating."

APPLICABLE The initial conditions of Design Basis Accident andSAFETY ANALYSES transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume

that Engineered Safety Feature systems are OPERABLE. The DCelectrical power system provides normal and emergency DCelectrical power for the diesel generators (DGs), emergencyauxiliaries, and control and switching during all MODES ofoperation.

The OPERABILITY of the DC subsystems is consistent with theinitial assumptions of the accident analyses and therequirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sourcesduring MODES 4 and 5 and during movement of irradiated fuelassemblies in secondary containment ensures that:

a. The facility can be maintained in the shutdown orrefueling condition for-extended periods;


c. Adequate DC electrical power is provided to mitigateevents postulated during shutdown, such as aninadvertent draindown of the vessel or a fuel handlingaccident.

The DC sources satisfy Criterion 3 of the NRC PolicyStatement.

LCO The Unit 2 DC electrical power subsystems, with each DCsubsystem consisting of two 125 V station batteries inseries, two battery chargers (one per battery), and thecorresponding control equipment and interconnecting cablingsupplying power to the associated bus, are required to be

(continued)



BASES

LCO(continued)

OPERABLE to support Unit 2 DC distribution subsystemsrequired OPERABLE by LCO 3.8.8, "Distribution Systems-Shutdown." When the equipment required OPERABLE: 1) doesnot require 250 VDC from the DC electrical power subsystem;and 2) does not require 125 VDC from one of the two 125 Vbatteries of the DC electrical power subsystem, the Unit 2DC electrical power subsystem requirements can be modifiedto only include one 125 V battery (the battery needed toprovide power to required equipment), an associated batterycharger, and the corresponding control equipment andinterconnecting cabling supplying 125 V power to theassociated bus. This exception is allowed only if all250 VDC loads are removed from the associated bus. Inaddition, DC control power (which provides control power forthe 4 kV load circuit breakers and the feeder breakers tothe 4 kV emergency bus) for two of the four 4 kV emergencybuses, as well as control power for two of the dieselgenerators, is provided by the Unit 3 DC electrical powersubsystems. Therefore, the Unit 3 DC electrical powersubsystems needed to support required components are alsorequired to be OPERABLE. The Unit 3 DC electrical powersubsystem OPERABILITY requirements are the same as thoserequired for a Unit 2 DC electrical power subsystem. Inaddition, battery chargers (Unit 2 and Unit 3) can bepowered from the opposite unit's AC source (as described inthe Background section of the Bases for LCO 3.8.4, "DCSources--Operating"), and be considered OPERABLE for thepurpose of meeting this LCO.

This requirement ensures the availability of sufficient DCelectrical power sources to operate the unit in a safemanner and to mitigate the consequences of postulated eventsduring shutdown (e.g., fuel handling accidents andinadvertent reactor vessel draindown).

APPLICABILITY The DC electrical power sources required to be OPERABLE inMODES 4 and 5 and during movement of irradiated fuelassemblies in the secondary containment provide assurancethat:

a. Required features to provide adequate coolantinventory makeup are available for the irradiated fuelassemblies in the core in case of an inadvertentdraindown of the reactor vessel;

(continued)



BASES

APPLICABILITY b. Required features needed to mitigate a fuel handling(continued) accident are available;

c. Required features necessary to mitigate the effects ofevents that can lead to core damage during shutdownare available; and


The DC electrical power requirements for MODES 1, 2, and 3are covered in LCO 3.8.4.

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However,since irradiated fuel assembly movement can occur in MODE 1,2, or 3, the ACTIONS have been modified by a Note statingthat LCO 3.0.3 is not applicable. If moving irradiated fuelassemblies while in MODE 4 or 5, LCO 3.0.3 would not specifyany action. If moving irradiated fuel assemblies while inMODE 1, 2, or 3, the fuel movement is independent of reactoroperations. Therefore, in either case, inability to suspendmovement of irradiated fuel assemblies would not besufficient reason to require a reactor shutdown.

A.1, A.2.1. A.2.2, A.2.3, and A.2.4

If more than one DC distribution subsystem is requiredaccording to LCO 3.8.8, the DC electrical power subsystemsremaining OPERABLE with one or more DC electrical powersubsystems inoperable may be capable of supportingsufficient required features to allow continuation of COREALTERATIONS, fuel movement, and operations with a potentialfor draining the reactor vessel.

By allowance of the option to declare required featuresinoperable with associated DC electrical power subsystemsinoperable, appropriate restrictions are implemented inaccordance with the affected system LCOs' ACTIONS. However,in many instances, this option may involve undesiredadministrative efforts. Therefore, the allowance forsufficiently conservative actions is made (i.e., to suspendCORE ALTERATIONS, movement of irradiated fuel assemblies insecondary containment, and any activities that could resultin inadvertent draining of the reactor vessel).

(continued)



BASES

ACTIONS A.1, A.2.1, A.2.2, A.2.3, and A.2.4 (continued)

Suspension of these activities shall not preclude completionof actions to establish a safe conservative condition.These actions minimize the probability of the occurrence ofpostulated events. It is further required to immediatelyinitiate action to restore the required DC electrical powersubsystems and to continue this action until restoration isaccomplished in order to provide the necessary DC electricalpower to the plant safety systems.

The Completion Time of immediately is consistent with therequired times for actions requiring prompt attention. Therestoration of the required DC electrical power subsystemsshould be completed as quickly as possible in order tominimize the time during which the plant safety systems maybe without sufficient power.


SR 3.8.5.1 requires performance of all Surveillancesrequired by SR 3.8.4.1 through SR 3.8.4.8. Therefore, seethe corresponding Bases for LCO 3.8.4 for a discussion ofeach SR.

This SR is modified by a Note. The reason for the Note isto preclude requiring the OPERABLE DC electrical powersubsystems from being discharged below their capability toprovide the required power supply or otherwise renderedinoperable during the performance of SRs. It is the intentthat these SRs must still be capable of being met, butactual performance is not required.

SR 3.8.5.2

This Surveillance is provided to direct that the appropriateSurveillances for the required Unit 3 DC electrical powersubsystems are governed by the Unit 3 TechnicalSpecifications. Performance of the applicable Unit 3Surveillances will satisfy Unit 3 requirements, as well assatisfying this Unit 2 Surveillance Requirement. TheFrequency required by the applicable Unit 3 SR also governsperformance of that SR for Unit 2.

(continued)



BASES


As Noted, if Unit 3 is in MODE 4 or 5, or moving irradiatedfuel assemblies in the secondary containment, the Note toUnit 3 SR 3.8.5.1 is applicable. This ensures that a Unit 2SR will not require a Unit 3 SR to be performed, when theUnit 3 Technical Specifications exempts performance of aUnit 3 SR. (However, as stated in the Unit 3 SR 3.8.5.1Note, while performance of an SR is exempted, the SR stillmust be met.)


PBAPS UNIT 2 B 3.8-76 URevision No. 0

Battery Cell ParametersB 3.8.6


B 3.8.6 Battery Cell Parameters

BASES

BACKGROUND This LCO delineates the limits on electrolyte temperature,level, float voltage, and specific gravity for the DCelectrical power subsystems batteries. A discussion ofthese batteries and their OPERABILITY requirements isprovided in the Bases for LCO 3.8.4, "DC Sources-Operating," and LCO 3.8.5, "DC Sources-Shutdown."


The initial conditions of Design Basis Accident (DBA) andtransient analyses in UFSAR, Chapter 14 (Ref. 1), assumeEngineered Safety Feature systems are OPERABLE. The DCelectrical power subsystems provide normal and emergency DCelectrical power for the diesel generators (DGs), emergencyauxiliaries, and control and switching during all MODES ofoperation.

The OPERABILITY of the DC subsystems is consistent with theinitial assumptions of the accident analyses and is basedupon meeting the design basis of the unit as discussed inthe Bases of LCO 3.8.4, "DC Sources-Operating," andLCO 3.8.5, "DC Sources-Shutdown.

Since battery cell parameters support the operation of theDC electrical power subsystems, they satisfy Criterion 3 ofthe NRC Policy Statement.

LCO Battery cell parameters must remain within acceptable limitsto ensure availability of the required DC power to shut downthe reactor and maintain it in a safe condition after anabnormal operational transient or a postulated DBA.Electrolyte limits are conservatively established, allowingcontinued DC electrical system function even with Category Aand B limits not met.

APPLICABILITY The battery cell parameters are required solely for thesupport of the associated DC electrical power subsystem.Therefore, these cell parameters are only required when theDC power source is required to be OPERABLE. Refer to theApplicability discussions in Bases for LCO 3.8.4 andLCO 3.8.5.

(continued)



BASES (continued)

ACTIONS A.I. A.2. and A.3

With parameters of one or more cells in one or morebatteries not within limits (i.e., Category A limits not metor Category B limits not met, or Category A and B limits notmet) but within the Category C limits specified inTable 3.8.6-1, the battery is degraded but there is stillsufficient capacity to perform the intended function.Therefore, the affected battery is not required to beconsidered inoperable solely as a result of Category A or Blimits not met, and continued operation is permitted for alimited period.

The pilot cell electrolyte level and float voltage arerequired to be verified to meet the Category C limits within1 hour (Required Action A.1). This check provides a quickindication of the status of the remainder of the batterycells. One hour provides time to inspect the electrolytelevel and to confirm the float voltage of the pilot cells.One hour is considered a reasonable amount of time toperform the required verification.

Verification that the Category C limits are met (RequiredAction A.2) provides assurance that during the time neededto restore the parameters to the Category A and B limits,the battery is still capable of performing its intendedfunction. A period of 24 hours is allowed to complete theinitial verification because specific gravity measurementsmust be obtained for each connected cell. Taking intoconsideration both the time required to perform the requiredverification and the assurance that the battery cellparameters are not severely degraded, this time isconsidered reasonable. The verification is repeated at7 day intervals until the parameters are restored toCategory A or B limits. This periodic verification isconsistent with the normal Frequency of pilot cellsurveillances.

Continued operation is only permitted for 31 days beforebattery cell parameters must be restored to withinCategory A and B limits. Taking into consideration that,while battery capacity is degraded, sufficient capacityexists to perform the intended function and to allow time tofully restore the battery cell parameters to normal limits,this time is acceptable for operation prior to declaring theDC batteries inoperable.

(continued)



BASES


When any battery parameter is outside the Category C limitfor any connected cell, sufficient capacity to supply themaximum expected load requirement is not ensured and thecorresponding DC electrical power subsystem must be declaredinoperable. Additionally, other potentially extremeconditions, such as not completing the Required Actions ofCondition A within the required Completion Time or averageelectrolyte temperature of representative cells fallingbelow 40"F, also are cause for immediately declaring theassociated DC electrical power subsystem inoperable.


This SR verifies that Category A battery cell parameters areconsistent with IEEE-450 (Ref. 2), which recommends regularbattery inspections (at least one per month) includingvoltage, specific gravity, and electrolyte temperature ofpilot cells. The SR must be performed every 7 days, unless(as specified by the Note in the Frequency) the battery ison equalize charge or has been on equalize charge any timeduring the previous 4 days. This allows the routine 7 dayFrequency to be extended until such a time that the SR canbe properly performed and meaningful results obtained. The14 day Frequency is not modified by the Note, thusregardless of how often the battery is placed on equalizecharge, the SR must be performed every 14 days.

SR 3.8.6.2

The quarterly inspection of specific gravity and voltage isconsistent with IEEE-450 (Ref. 2). In addition, within24 hours of a battery discharge < 100 V or within 24 hoursof a battery overcharge > 145 V, the battery must bedemonstrated to meet Category B limits. Transients, such asmotor starting transients which may momentarily causebattery voltage to drop to s 100 V, do not constitutebattery discharge provided the battery terminal voltage andfloat current return to pre-transient values. Thisinspection is also consistent with IEEE-450 (Ref. 2), whichrecommends special inspections following a severe dischargeor overcharge, to ensure that no significant degradation ofthe battery occurs as a consequence of such discharge orovercharge.

(continued)



BASES


(continued) This Surveillance verification that the average temperatureof representative cells is within limits is consistent witha recommendation of IEEE-450 (Ref. 2) that states that thetemperature of electrolytes in representative cells shouldbe determined on a quarterly basis.

Lower than normal temperatures act to inhibit or reducebattery capacity. This SR ensures that the operatingtemperatures remain within an acceptable operating range.

Table 3.8.6-1

This table delineates the limits on electrolyte level, floatvoltage, and specific gravity for three differentcategories. The meaning of each category is discussedbelow.

Category A defines the normal parameter limit for eachdesignated pilot cell in each battery. The cells selectedas pilot cells are those whose temperature, voltage, andelectrolyte specific gravity approximate the state of chargeof the entire battery.

The Category A limits specified for electrolyte level arebased on manufacturer's recommendations and are consistentwith the guidance in IEEE-450 (Ref. 2), with the extra4 inch allowance above the high water level indication foroperating margin to account for temperature and chargeeffects. In addition to this allowance, footnote a toTable 3.8.6-1 permits the electrolyte level to be above thespecified maximum level during equalizing charge, providedit is not overflowing. These limits ensure that the platessuffer no physical damage, and that adequate electrontransfer capability is maintained in the event of transientconditions. IEEE-450 (Ref. 2) recommends that electrolytelevel readings should be made only after the battery hasbeen at float charge for at least 72 hours.

The Category A limit specified for float voltage is ; 2.13 Vper cell. This value is based on the recommendation ofIEEE-450 (Ref. 2), which states that prolonged operation ofcells below 2.13 V can reduce the life expectancy of cells.The Category A limit specified for specific gravity for eachpilot cell is • 1.195 (0.020 below the manufacturer's fully

(continued)



BASES

SURVEILLANCE Table 3.8.6-1 (continued)REQUIREMENTS

charged nominal specific gravity or a battery chargingcurrent that had stabilized at a low value). This value ischaracteristic of a charged cell with adequate capacity.According to IEEE-450 (Ref. 2), the specific gravityreadings are based on a temperature of 77"F (25"C).

The specific gravity readings are corrected for actualelectrolyte temperature and level. For each 3'F (1.67"C)above 77"F (25"C), 1 point (0.001) is added to the reading;1 point is subtracted for each 3"F below 770F. The specificgravity of the electrolyte in a cell increases with a lossof water due to electrolysis or evaporation. Levelcorrection will be in accordance with manufacturer'srecommendations.

Category B defines the normal parameter limits for eachconnected cell. The term "connected cell" excludes anybattery cell that may be jumpered out.

The Category B limits specified for electrolyte level andfloat voltage are the same as those specified for Category Aand have been discussed above. The Category B limitspecified for specific gravity for each connected cell ise 1.195 (0.020 below the manufacturer's fully charged,nominal specific gravity) with the average of all connectedcells 1.205 (0.010 below the manufacturer's fully charged,nominal specific gravity). These values were developed frommanufacturer's recommendations. The minimum specificgravity value required for each cell ensures that theeffects of a highly charged or newly installed cell do notmask overall degradation of the battery.

Category C defines the limit for each connected cell. Thesevalues, although reduced, provide assurance that sufficientcapacity exists to perform the intended function andmaintain a margin of safety. When any battery parameter isoutside the Category C limit, the assurance of sufficientcapacity described above no longer exists, and the batterymust be declared inoperable.

The Category C limit specified for electrolyte level (abovethe top of the plates and not overflowing) ensure that theplates suffer no physical damage and maintain adequateelectron transfer capability. The Category C AllowableValue for voltage is based on IEEE-450 (Ref. 2), which

(continued)



BASES

SURVEILLANCE Table 3.8.6-1 (continued)REQUIREMENTS

states that a cell voltage of 2.07 V or below, under floatconditions and not caused by elevated temperature of thecell, indicates internal cell problems and may require cellreplacement.

The Category C limit of average specific gravity 2 1.190, isbased on manufacturer's recommendations. In addition tothat limit, it is required that the specific gravity foreach connected cell must be no less than 0.020 below theaverage of all connected cells. This limit ensures that theeffect of a highly charged or new cell does not mask overalldegradation of the battery.

The footnotes to Table 3.8.6-1 that apply to specificgravity are applicable to Category A, B, and C specificgravity. Footnote b of Table 3.8.6-1 requires the abovementioned correction for electrolyte level and temperature,with the exception that level correction is not requiredwhen battery charging current, while on float charge, is< 1 amp. This current provides, in general, an indicationof overall battery condition.

Because of specific gravity gradients that are producedduring the recharging process, delays of several days mayoccur while waiting for the specific gravity to stabilize.A stabilized charger current is an acceptable alternative tospecific gravity measurement for determining the state ofcharge of the designated pilot cell. This phenomenon isdiscussed in IEEE-450 (Ref. 2). Footnote c to Table 3.8.6-1allows the float charge current to be used as an alternateto specific gravity for up to 180 days following a batteryrecharge after a deep discharge. Within 180 days eachconnected cell's specific gravity must be measured toconfirm the state of charge. Following a minor batteryrecharge (such as equalizing charge that does not follow adeep discharge) specific gravity gradients are notsignificant, and confirming measurements must be made within30 days.




Distribution Systems-OperatingB 3.8.7


B 3.8.7 Distribution Systems--Operating

BASES

BACKGROUND The onsite Class IE AC and DC electrical power distributionsystem is divided into redundant and independent AC and DCelectrical power distribution subsystems.

The primary AC distribution system for Unit 2 consists offour 4 kV emergency buses each having two offsite sources ofpower as well as an onsite diesel generator (DG) source.Each 4 kV emergency bus is connected to its normal source ofpower via either emergency auxiliary transformer no. 2 orno. 3. During a loss of the normal supply of offsite powerto the 4 kV emergency buses, the alternate supply breakerfrom the alternate supply of offsite power for the 4 kVemergency buses attempts to close. If all offsite sourcesare unavailable, the onsite emergency DGs supply power tothe 4 kV emergency buses. (However, these supply breakersare not governed by this LCO; they are governed byLCO 3.8.1, "AC Sources-Operating".)

The secondary plant distribution system for Unit 2 includes480 VAC load centers E124, E224, E324, and E424.

There are two independent 125/250 VDC electrical powerdistribution subsystems for Unit 2 that support thenecessary power for ESF functions.

In addition, since some components required by Unit 2receive power through Unit 3 electrical power distributionsubsystems, the Unit 3 AC and DC electrical powerdistribution subsystems needed to support the requiredequipment are also addressed in LCO 3.8.7. A description ofthe Unit 3 AC and DC Electrical Power Distribution System isprovided in.the Bases for Unit 3 LCO 3.8.7, "DistributionSystem-Operating."

The list of required Unit 2 distribution buses is presented

in Table B 3.8.7-1.

(continued)



BASES (continued)


The initial conditions of Design Basis Accident (DBA) andtransient analyses in the UFSAR, Chapter 14'(Ref. 1), assumeEngineered Safety Feature (ESF) systems are OPERABLE. TheAC and DC electrical power distribution systems are designedto provide sufficient capacity, capability, redundancy, andreliability to ensure the availability of necessary power toESF systems so that the fuel, Reactor Coolant System, andcontainment design limits are not exceeded. These limitsare discussed in more detail in the Bases for Section 3.2,Power Distribution Limits; Section 3.5, Emergency CoreCooling Systems (ECCS) and Reactor Core Isolation Cooling(RCIC) System; and Section 3.6 Containment Systems.

The OPERABILITY of the AC and DC electrical powerdistribution subsystems is consistent with the initialassumptions of the accident analyses and is based uponmeeting the design basis of the unit. This includesmaintaining distribution systems OPERABLE during accidentconditions in the event of:

a. An assumed loss of all offsite power or all onsite

AC electrical power; and

b. A postulated worst case single failure.

The AC and DC electrical power distribution system satisfiesCriterion 3 of the NRC Policy Statement.

LCO The Unit 2 AC and DC electrical power distributionsubsystems are required to be OPERABLE. The required Unit 2electrical power distribution subsystems listed inTable B 3.8.7-1 ensure the availability of AC and DCelectrical power for the systems required to shut down thereactor and maintain it in a safe condition after anabnormal operational transient or a postulated DBA. Asstated in the Table, each division of the AC and DCelectrical power distribution systems is a subsystem. Inaddition, since some components required by Unit 2 receivepower through Unit 3 electrical power distributionsubsystems (e.g., Standby Gas Treatment (SGT) System,emergency heat sink components, and DC control power for twoof the four 4 kV emergency buses, as well as control powerfor two of the diesel generators), the Unit 3 AC and DC

(continued)



BASES

LCO electrical power distribution subsystems needed to support(continued) the required equipment must also be OPERABLE. The Unit 3

electrical power distribution subsystems that may berequired are listed in Unit 3 Table B 3.8.7-1.

Maintaining the Unit 2 Division I and II and requiredUnit 3AC and DC electrical power distribution subsystems OPERABLEensures that the redundancy incorporated into the design ofESF is not defeated. Therefore, a single failure within anysystem or within the electrical power distributionsubsystems will not prevent safe shutdown of the reactor.

The Unit 2 and Unit 3 AC electrical power distributionsubsystems require the associated buses and electricalcircuits to be energized to their proper voltages. TheUnit 2 and Unit 3 DC electrical power distributionsubsystems require the associated buses to be energized totheir proper voltage from either the associated batteries orchargers. However, when a Unit 3 DC electrical powersubsystem is only required to have one 125 V battery andassociated battery charger to be considered OPERABLE (asdescribed in the LCO section of the Bases for LCO 3.8.4, "DCSources-Operating"), the proper voltage to which theassociated bus is required to be energized is lowered from250 V to 125 V (as read from the associated batterycharger).

Based on the number of safety significant electrical loadsassociated with each electrical power distribution component(i.e., bus, load center, or distribution panel) listed inTable B 3.8.7-1, if one or more of the electrical powerdistribution components within a division (listed in Table3.8.7-1) becomes inoperable, entry into the appropriateACTIONS of LCO 3.8.7 is required. Other electrical powerdistribution components such as motor control centers (MCC)and distribution panels, which help comprise the AC and DCdistribution systems are not listed in Table B 3.8.7-1. Theloss of electrical loads associated with these electricalpower distribution components may not result in a completeloss of a redundant safety function necessary to shut downthe reactor and maintain it in a safe condition. Therefore,should one or more of these electrical power distributioncomponents become inoperable due to a failure not affectingthe OPERABILITY of an electrical power distributioncomponent listed in Table B 3.8.7-1 (e.g., a breakersupplying a single MCC fails open), the individual loads onthe electrical power distribution component would be

(continued)



BASES

LCO(continued)

considered inoperable, and the appropriate Conditions andRequired Actions of the LCOs governing the individual loadswould be entered. If however, one or more of theseelectrical power distribution components is inoperable dueto a failure also affecting the OPERABILITY of an electricalpower distribution component listed in Table B 3.8.7-1(e.g., loss of a 4 kV emergency bus, which results in de-energization of all electrical power distribution componentspowered from the 4 kV emergency bus), while these electricalpower distribution components and individual loads are stillconsidered inoperable, the Conditions and Required Actionsof the LCO for the individual loads are not required to beentered, since LCO 3.0.6 allows this exception (i.e., theloads are inoperable due to the inoperability of a supportsystem governed by a Technical Specification; the 4 kVemergency bus).

In addition, transfer switches between redundant safetyrelated Unit 2 and Unit 3 AC and DC power distributionsubsystems must be open. This prevents any electricalmalfunction in any power distribution subsystem frompropagating to the redundant subsystem, which could causethe failure of a redundant subsystem and a loss of essentialsafety function(s). If any transfer switches are closed,the electrical power distribution subsystem which is notbeing powered from its normal source (i.e., it is beingpowered from its redundant electrical power distributionsubsystem) is considered inoperable. This applies to theonsite, safety related, redundant electrical powerdistribution subsystems. It does not, however, precluderedundant Class IE 4 kV emergency buses from being poweredfrom the same offsite circuit.

APPLICABILITY The electrical power distribution subsystems are required tobe OPERABLE in MODES 1, 2, and 3 to ensure that:


b. Adequate core cooling is provided, and containmentOPERABILITY and other vital functions are maintainedin the event of a postulated DBA.

(continued)



BASES

APPLICABILITY Electrical power distribution subsystem requirements for(continued) MODES 4 and 5 and other conditions in which AC and DC

electrical power distribution subsystems are required, arecovered in LCO 3.8.8, "Distribution Systems-Shutdown."

ACTIONS A.1

Pursuant to LCO 3.0.6, the DC Sources-Operating ACTIONSwould not be entered even if the AC electrical powerdistribution subsystem inoperability resulted in de-energization of a required battery charger. Therefore, theRequired Actions of Condition A are modified by a Note toindicate that when Condition A results in de-energization ofa required Unit 3 battery charger, Actions for LCO 3.8.4must be immediately entered. This allows Condition A toprovide requirements for the loss of a Unit 3 AC electricalpower distribution subsystem without regard to whether abattery charger is de-energized. LCO 3.8.4 provides theappropriate restriction for a de-energized battery charger.

If one or more of the required Unit 3 AC electrical powerdistribution subsystems are inoperable, and a loss offunction has not occurred as described in Condition F, theremaining AC electrical power distribution subsystems havethe capacity to support a safe shutdown and-to mitigate anaccident condition. Since a subsequent worst case singlefailure could, however, result in the loss of certain safetyfunctions, continued power operation should not exceed7 days. The 7 day Completion Time takes into account thecapacity and capability of the remaining AC electrical powerdistribution subsystems, and is based on the shortestrestoration time allowed for the systems affected by theinoperable AC electrical power distribution subsystem in therespective system Specification.

B.I

If one of the Unit 3 DC electrical power distributionsubsystems is inoperable, the remaining DC electrical powerdistribution subsystems have the capacity to support a safeshutdown and to mitigate an accident condition. Since asubsequent worst case single failure could, however, resultin the loss of safety function, continued power operationshould not exceed 12 hours. The 12 hour Completion Time

(continued)



BASES

ACTIONS B.I (continued)

reflects a reasonable time to assess unit status as afunction of the inoperable DC electrical power distributionsubsystem and takes into consideration the importance of theUnit 3 DC electrical power distribution subsystem.

C.'

With one Unit 2 AC electrical power distribution subsysteminoperable, the remaining AC electrical power distributionsubsystems are capable of supporting the minimum safetyfunctions necessary to shut down the reactor and maintain itin a safe shutdown condition, assuming no single failure.The overall reliability is reduced, however, because asingle failure in the remaining power distributionsubsystems could result in the minimum required ESFfunctions not being supported. Therefore, the Unit 2 ACelectrical power distribution subsystem must be restored toOPERABLE status within 8 hours.

The Condition C worst scenario is one 4 kV emergency buswithout AC power (i.e., no offsite power to the 4 kVemergency bus and the associated DG inoperable). In thisCondition, the unit is more vulnerable to a complete loss ofUnit 2 AC power. It is, therefore, imperative that the unitoperators' attention be focused on minimizing the potentialfor loss of power to the remaining buses by stabilizing theunit, and on restoring power to the affected bus(es). The8 hour time limit before requiring a unit shutdown in thisCondition is acceptable because:

a. There is a potential for decreased safety if the unitoperators' attention is diverted from the evaluationsand actions necessary to restore power to the affectedbus(es) to the actions associated with taking the unitto shutdown within this time limit.

b. The potential for an event in conjunction with asingle failure of a redundant component in thedivision with AC power. (The redundant component isverified OPERABLE in accordance withSpecification 5.5.11, "Safety Function DeterminationProgram (SFDP).")

(continued)



BASES

ACTIONS C.1_ (continued)

The second Completion Time for Required Action C.1establishes a limit on the maximum time allowed for anycombination of required distribution subsystems to beinoperable during any single contiguous occurrence offailing to meet LCO 3.8.7.a. If Condition C is enteredwhile, for instance, a Unit 2 DC bus is inoperable andsubsequently returned OPERABLE, this LCO may already havebeen not met for up to 2 hours. This situation could leadto a total duration of 10 hours, since initial failure ofthe LCO, to restore the Unit 2 AC Electrical PowerDistribution System. At this time a Unit 2 DC bus couldagain become inoperable, and Unit 2 AC Electrical PowerDistribution System could be restored OPERABLE. This couldcontinue indefinitely.

This Completion Time allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."This results in establishing the "time zero" at the timeLCO 3.8.7.a was initially not met, instead of at the timeCondition C was entered. The 16 hour Completion Time is anacceptable limitation on this potential to fail to meet theLCO 3.8.7.a indefinitely.

D._1

With one Unit 2 DC electrical power distribution subsysteminoperable, the remaining DC electrical power distributionsubsystem is capable of supporting the minimum safetyfunctions necessary to shut down the reactor and maintain itin a safe shutdown condition, assuming no single failure.The overall reliability is reduced, however, because asingle failure in the remaining DC electrical powerdistribution subsystem could result in the minimum requiredESF functions not being supported. Therefore, the Unit 2 DCelectrical power distribution subsystem must be restored toOPERABLE status within 2 hours.

Condition D represents one Unit 2 electrical powerdistribution subsystem without adequate DC power,potentially with both the battery(s) significantly degradedand the associated charger(s) nonfunctioning. In thissituation the plant is significantly more vulnerable to acomplete loss of all Unit 2 DC power. It is, therefore,imperative that the operator's attention focus on

(continued)



BASES


stabilizing the plant, minimizing the potential for loss ofpower to the remaining electrical power distributionsubsystem, and restoring power to the affected electricalpower distribution subsystem.

This 2 hour limit is more conservative than Completion Timesallowed for the majority of components that would be withoutpower. Taking exception to LCO 3.0.2 for components withoutadequate DC power, which would have Required ActionCompletion Times shorter than 2 hours, is acceptable becauseof:

a. The potential for decreased safety when requiring achange in plant conditions (i.e., requiring ashutdown) while not allowing stable operations tocontinue;

b. The potential for decreased safety when requiringentry into numerous applicable Conditions and RequiredActions for components without DC power, while notproviding sufficient time for the operators to performthe necessary evaluations and actions for restoringpower to the affected subsystem;

c. The potential for an event in conjunction with asingle failure of a redundant component.

The 2 hour Completion Time for DC electrical powerdistribution subsystems is consistent with RegulatoryGuide 1.93 (Ref. 2).

The second Completion Time for Required Action D.1establishes a limit on the maximum time allowed for anycombination of required electrical power distributionsubsystems to be inoperable during any single contiguousoccurrence of failing to meet LCO 3.8.7.a. If Condition Dis entered while, for instance, a Unit 2 AC bus isinoperable and subsequently restored OPERABLE, LCO 3.8.7.amay already have been not met for up to 8 hours. Thissituation could lead to a total duration of 10 hours, sinceinitial failure of LCO 3.8.7.a, to restore the Unit 2 DCElectrical Power Distribution System. At this time, aUnit 2 AC bus could again become inoperable, and Unit 2 DCElectrical Power Distribution System could be restoredOPERABLE. This could continue indefinitely.

(continued)



BASES


This Completion Time allows for an exception to the normal"time zero" for beginning the allowed outage time "clock."This allowance results in establishing the "time zero" atthe time LCO 3.8.7.a was initially not met, instead of atthe time Condition D was entered. The 16 hour CompletionTime is an acceptable limitation on this potential offailing to meet the LCO indefinitely.

E.1 and E.2

If the inoperable electrical power distribution subsystemcannot be restored to OPERABLE status within the associatedCompletion Time, the unit must be brought to a MODE in whichthe LCO does not apply. To achieve this status, the plantmust be brought to at least MODE 3 within 12 hours and toMODE 4 within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach therequired plant conditions from full power conditions in anorderly manner and without challenging plant systems.

F.1_.

Condition F corresponds to a level of degradation in theelectrical power distribution system that causes a requiredsafety function to be lost. When more than one Condition isentered, and this results in the loss of a requiredfunction, the plant is in a condition outside the accidentanalysis. Therefore, no additional time is justified forcontinued operation. LCO 3.0.3 must be entered immediatelyto commence a controlled shutdown.


This Surveillance verifies that the AC and DC electricalpower distribution systems are functioning properly, withthe correct circuit breaker alignment (for the AC electricalpower distribution system only). The correct AC breakeralignment ensures the appropriate separation andindependence of the electrical buses are maintained, andpower is available to each required bus. The verificationof indicated power availability on the AC and DC buses

(continued)



BASES

SURVEILLANCE SR 3.8.7.1 (continued)REQUIREMENTS ensures that the required power is readily available for

motive as well as control functions for critical systemloads connected to these buses. This may be performed byverification of absence of low voltage alarms. The 7 dayFrequency takes into account the redundant capability of theAC and DC electrical power distribution subsystems, andother indications available in the control room that alertthe operator to subsystem malfunctions.


2. Regulatory Guide 1.93, December 1974.



Table B 3.8.7-1 (page 1 of 1)AC and DC Electrical Power Distribution Systems

TYPE VOLTAGE DIVISION I* DIVISION II*

AC buses 4160 V Emergency Buses Emergency BusesE12, E32 E22, E42

480 V Load Centers Load CentersE124, E324 E224, E424

DC buses 250 V Distribution Panel Distribution Panel2AD]8 2BDI8

* Each division of the AC and DC electrical power distribution systems is

a subsystem.


Distribution Systems-ShutdownB 3.8.8


B 3.8.8 Distribution Systems--Shutdown

BASES

BACKGROUND A description of the AC and DC electrical power distributionsystem is provided in the Bases for LCO 3.8.7, "DistributionSystems-Operating."


The initial conditions of Design Basis Accident andtransient analyses in the UFSAR, Chapter 14 (Ref. 1), assumeEngineered Safety Feature (ESF) systems are OPERABLE. TheAC and DC electrical power distribution systems are designedto provide sufficient capacity, capability, redundancy, andreliability to ensure the availability of necessary power toESF systems so that the fuel, Reactor Coolant System, andcontainment design limits are not exceeded.

The OPERABILITY of the AC and DC electrical powerdistribution system is consistent with the initialassumptions of the accident analyses and the requirementsfor the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC and DC electrical powersources and associated power distribution subsystems duringMODES 4 and 5 and during movement of irradiated fuelassemblies in the secondary containment ensures that:

a. The facility can be maintained in the shutdown orrefueling condition for extended periods;


c. Adequate power is provided to mitigate eventspostulated during shutdown, such as an inadvertentdraindown of the vessel or a fuel handling accident.

The AC and DC electrical power distribution systems satisfyCriterion 3 of the NRC Policy Statement.

(continued)



BASES (continued)

LCO Various combinations of subsystems, equipment, andcomponents are required OPERABLE by other LCOs, depending onthe specific plant condition. Implicit in thoserequirements is the required OPERABILITY of necessarysupport required features. This LCO explicitly requiresenergization of the portions of the Unit 2 electricaldistribution system necessary to support OPERABILITY ofTechnical Specifications required systems, equipment, andcomponents-both specifically addressed by their own LCO,and implicitly required by the definition of OPERABILITY.In addition, some components that may be required by Unit 2receive power through Unit 3 electrical power distributionsubsystems (e.g., Standby Gas Treatment (SGT) System and DCcontrol power for two of the four 4 kV emergency buses, aswell as control power for two of the diesel generators).Therefore, Unit 3 AC and DC electrical power distributionsubsystems needed to support the required equipment mustalso be OPERABLE.

In addition, it is acceptable for required buses to becross-tied during shutdown conditions, permitting a singlesource to supply multiple redundant buses, provided thesource is capable of maintaining proper frequency (ifrequired) and voltage.

Maintaining these portions of the distribution systemenergized ensures the availability of sufficient power tooperate the plant in a safe manner to mitigate theconsequences of postulated events during shutdown (e.g.,fuel handling accidents and inadvertent reactor vesseldraindown).

APPLICABILITY The AC and DC electrical power distribution subsystemsrequired to be OPERABLE in MODES 4 and 5 and during movementof irradiated fuel assemblies in the secondary containmentprovide assurance that:

a. Systems to provide adequate coolant inventory makeupare available for the irradiated fuel in the core incase of an inadvertent draindown of the reactorvessel;

b. Systems needed to mitigate a fuel handling accidentare available;

(continued)



BASES

APPLICABILITY c. Systems necessary to mitigate the effects of events(continued) that can lead to core damage during shutdown are

available; and


The AC and DC electrical power distribution subsystemrequirements for MODES 1, 2, and 3 are covered in LCO 3.8.7.

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However,since irradiated fuel assembly movement can occur in MODE I,2, or 3, the ACTIONS have been modified by a Note statingthat LCO 3.0.3 is not applicable. If moving irradiated fuelassemblies while in MODE 4 or 5, LCO 3.0.3 would not specifyany action. If moving irradiated fuel assemblies while inMODE 1, 2, or 3, the fuel movement is independent of reactoroperations. Therefore, in either case, inability to suspendmovement of irradiated fuel assemblies would not besufficient reason to require a reactor shutdown.

A.I. A.2.I. A.2.2. A.2.3. A.2.4, and A.2.5

Although redundant required features may require redundantelectrical power distribution subsystems to be OPERABLE, oneOPERABLE distribution subsystem may be capable of supportingsufficient required features to allow continuation of COREALTERATIONS, fuel movement, and operations with a potentialfor draining the reactor vessel. By allowing the option todeclare required features inoperable with associatedelectrical power distribution subsystems inoperable,appropriate restrictions are implemented in accordance withthe affected distribution subsystem LCO's Required Actions.However, in many instances this option may involve undesiredadministrative efforts. Therefore, the allowance forsufficiently conservative actions is made, (i.e., to suspendCORE ALTERATIONS, movement of irradiated fuel assemblies inthe secondary containment, and any activities that couldresult in inadvertent draining of the reactor vessel).

(continued)



BASES

ACTIONS A.], A.2.1, A.2.2, A.2.3. A.2.4. and A.2.5 (continued)

Suspension of these activities shall not preclude completionof actions to establish a safe conservative condition.These actions minimize the probability of the occurrence ofpostulated events. It is further required to immediatelyinitiate action to restore the required AC and DC electricalpower distribution subsystems and to continue this actionuntil restoration is accomplished in order to provide thenecessary power to the plant safety systems.

Notwithstanding performance of the above conservativeRequired Actions, a required residual heat removal-shutdowncooling (RHR-SDC) subsystem may be inoperable. In thiscase, Required Actions A.2.1 through A.2.4 do not adequatelyaddress the concerns relating to coolant circulation andheat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONSwould not be entered. Therefore, Required Action A.2.5 isprovided to direct declaring RHR-SDC inoperable, whichresults in taking the appropriate RHR-SDC ACTIONS.

The Completion Time of immediately is consistent with therequired times for actions requiring prompt attention. Therestoration of the required electrical power distributionsubsystems should be completed as quickly as possible inorder to minimize the time the plant safety systems may bewithout power.


This Surveillance verifies that the AC and DC electricalpower distribution subsystem is functioning properly, withthe buses energized. The verification of indicated poweravailability on the buses ensures that the required power isreadily available for motive as well as control functionsfor critical system loads connected to these buses. Thismay be performed by verification of absence of low voltagealarms. The 7 day Frequency takes into account theredundant capability of the electrical power distributionsubsystems, as well as other indications available in thecontrol room that alert the operator to subsystemmalfunctions.

REFERENCES I. UFSAR, Chapter 14.


Refueling Equipment InterlocksB 3.9.1


B 3.9.1 Refueling Equipment Interlocks

BASES

BACKGROUND Refueling equipment interlocks restrict the operation of therefueling equipment or the withdrawal of control rods toreinforce unit procedures that prevent the reactor fromachieving criticality during refueling. The refuelinginterlock circuitry senses the conditions of the refuelingequipment and the control rods. Depending on the sensedconditions, interlocks are actuated to prevent the operationof the refueling equipment or the withdrawal of controlrods.

Design criteria require that one of the two requiredindependent reactivity control systems be capable of holdingthe reactor core subcritical under cold conditions (Ref. 1).The control rods, when fully inserted, serve as the systemcapable of maintaining the reactor subcritical in coldconditions during all fuel movement activities andaccidents.

One channel of instrumentation is provided to sense theposition of the refueling platform, the loading of therefueling platform fuel grapple and the full insertion ofall control rods. Additionally, inputs are provided for theloading of the refueling platform frame mounted auxiliaryhoist and the loading of the refueling platform monorailmounted hoist. With the reactor mode switch in the shutdownor refueling position, the indicated conditions are combinedin logic circuits to determine if all restrictions onrefueling equipment operations and control rod insertion aresatisfied.

A control rod not at its full-in position interrupts powerto the refueling equipment and prevents operating theequipment over the reactor core when loaded with a fuelassembly. Conversely, the refueling equipment located overthe core and loaded with fuel inserts a control rodwithdrawal block in the Reactor Manual Control System toprevent withdrawing a control rod.

(continued)



BASES


The refueling platform has two mechanical switches that openbefore the platform or any of its hoists are physicallylocated over the reactor vessel. All refueling hoists haveswitches that open when the hoists are loaded with fuel.

The refueling interlocks use these indications to preventoperation of the refueling equipment with fuel loaded overthe core whenever any control rod is withdrawn, or toprevent control rod withdrawal whenever fuel loadedrefueling equipment is over the core (Ref. 2).

The hoist switches open at a load lighter than the weight ofa single fuel assembly in water.


The refueling interlocks are explicitly assumed in the UFSARanalyses for the control rod removal error during refueling(Ref. 3) and the fuel assembly insertion error duringrefueling (Ref. 4). These analyses evaluate theconsequences of control rod withdrawal during refueling andalso fuel assembly insertion with a control rod withdrawn.A prompt reactivity excursion during refueling couldpotentially result in fuel failure with subsequent releaseof radioactive material to the environment.

Criticality and, therefore, subsequent prompt reactivityexcursions are prevented during the insertion of fuel,provided all control rods are fully inserted during the fuelinsertion. The refueling interlocks accomplish this bypreventing loading of fuel into the core with any controlrod withdrawn or by preventing withdrawal of a rod from thecore during fuel loading.

The refueling platform location switches activate at a pointoutside of the reactor core such that, with a fuel assemblyloaded and a control rod withdrawn, the fuel is not over thecore.

Refueling equipment interlocks satisfy Criterion 3 of theNRC Policy Statement.

(continued)

PBAPS UNIT 2 B 3.9-2 B Revision.No. 0


BASES (continued)

LCO To prevent criticality during refueling, the refuelinginterlocks ensure that fuel assemblies are not loaded withany control rod withdrawn.

To prevent these conditions from developing, theall-rods-in, the refueling platform position, the refuelingplatform fuel grapple fuel loaded, the refueling platformframe mounted auxiliary hoist fuel loaded, and the refuelingplatform monorail mounted hoist fuel loaded inputs arerequired to be OPERABLE. These inputs are combined in logiccircuits, which provide refueling equipment or control rodblocks to prevent operations that could result incriticality during refueling operations.

APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fueldamage and subsequent release of radioactive material to theenvironment. The refueling equipment interlocks protectagainst prompt reactivity excursions during MODE 5. Theinterlocks are required to be OPERABLE during in-vessel fuelmovement with refueling equipment associated with theinterlocks.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head ison, and in-vessel fuel movements are not possible.Therefore, the refueling interlocks are not required to beOPERABLE in these MODES.

ACTIONS A. I

With one or more of the required refueling equipmentinterlocks inoperable, the unit must be placed in acondition in which the LCO does not apply. In-vessel fuelmovement with the affected refueling equipment must beimmediately suspended. This action ensures that operationsare not performed with equipment that would potentially notbe blocked from unacceptable operations (e.g., loading fuelinto a cell with a control rod withdrawn). Suspension ofin-vessel fuel movement shall not preclude completion ofmovement of a component to a safe position.

(continued)



BASES (continued)


SR 3.9.1.1

Performance of a CHANNEL FUNCTIONAL TEST demonstrates eachrequired refueling equipment interlock will functionproperly when a simulated or actual signal indicative of arequired condition is injected into the logic. The CHANNELFUNCTIONAL TEST may be performed by any series ofsequential, overlapping, or total channel steps so that theentire channel is tested.

The 7 day Frequency is based on engineering judgment and isconsidered adequate in view of other indications ofrefueling interlocks and their associated input status thatare available to unit operations personnel.

REFERENCES 1. UFSAR, Sections 1.5.1.1, 1.5.1.8.1, 1.5.2.2.7, and

1.5.2.7.1.





Refuel Position One-Rod-Out InterlockB 3.9.2


B 3.9.2 Refuel Position One-Rod-Out Interlock

BASES

BACKGROUND The refuel position one-rod-out interlock restricts themovement of control rods to reinforce unit procedures thatprevent the reactor from becoming critical during refuelingoperations. During refueling operations, no more than onecontrol rod is permitted to be withdrawn.

The UFSAR design criteria require that one of the tworequired independent reactivity control systems be capableof holding the reactor core subcritical under coldconditions (Ref. 1). The control rods serve as the systemcapable of maintaining the reactor subcritical in coldconditions.

The refuel position one-rod-out interlock prevents theselection of a second control rod for movement when anyother control rod is not fully inserted (Ref. 2). It is alogic circuit that has redundant channels. It uses the allrods-in signal (from the control rod full-in positionindicators discussed in LCO 3.9.4, "Control Rod PositionIndication") and a rod selection signal (from the ReactorManual Control System).

This Specification ensures that the performance of therefuel position one-rod-out interlock in the event of aDesign Basis Accident meets the assumptions used in thesafety analysis of Reference 3.


The refueling position one-rod-out interlock is explicitlyassumed in the UFSAR analysis for the control rod withdrawalerror during refueling (Ref. 3). This analysis evaluatesthe consequences of control rod withdrawal during refueling.A prompt reactivity excursion during refueling couldpotentially result in fuel failure with subsequent releaseof radioactive material to the environment.

The refuel position one-rod-out interlock and adequate SDM(LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") prevent criticality bypreventing withdrawal of more than one control rod. Withone control rod withdrawn, the core will remain subcritical,thereby preventing any prompt critical excursion.

(continued)



BASES

APPLICABLE The refuel position one-rod-out interlock satisfiesSAFETY ANALYSES Criterion 3 of the NRC Policy Statement.

(continued)

LCO To prevent criticality during MODE 5, the refuel positionone-rod-out interlock ensures no more than one control rodmay be withdrawn. Both channels of the refuel positionone-rod-out interlock are required to be OPERABLE, and thereactor mode switch must be locked in the Refuel position tosupport the OPERABILITY of these channels.

APPLICABILITY In MODE 5, with the reactor mode switch in the refuelposition, the OPERABLE refuel position one-rod-out interlockprovides protection against prompt reactivity excursions.

In MODES 1, 2, 3, and 4, the refuel position one-rod-outinterlock is not required to be OPERABLE and is bypassed.In MODES I and 2, the Reactor Protection System(LCO 3.3.1.1) and the control rods (LCO 3.1.3) providemitigation of potential reactivity excursions. In MODES 3and 4, with the reactor mode switch in the shutdownposition, a control rod block (LCO 3.3.2.1) ensures. allcontrol rods are inserted, thereby preventing criticalityduring shutdown conditions.

ACTIONS A.1 and A.2

With one or both channels of the refueling positionone-rod-out interlock inoperable, the refueling interlocksmay not be capable of preventing more than one control rodfrom being withdrawn. This condition may lead tocriticality.

Control rod withdrawal must be immediately suspended, andaction must be immediately initiated to fully insert allinsertable control rods in core cells containing one or morefuel assemblies. Action must continue until all suchcontrol rods are fully inserted. Control rods in core cellscontaining no fuel assemblies do not affect the reactivityof the core and, therefore, do not have to be inserted.

(continued)



BASES (continued)


Proper functioning of the refueling position one-rod-outinterlock requires the reactor mode switch to be in Refuel.During control rod withdrawal in MODE 5, improperpositioning of the reactor mode switch could, in someinstances, allow improper bypassing of required interlocks.Therefore, this Surveillance imposes an additional level ofassurance that the refueling position one-rod-out interlockwill be OPERABLE when required. By "locking" the reactormode switch in the proper position (i.e., removing thereactor mode switch key from the console while the reactormode switch is positioned in refuel), an additionaladministrative control is in place to preclude operatorerrors from resulting in unanalyzed operation.

The Frequency of 12 hours is sufficient in view of otheradministrative controls utilized during refueling operationsto ensure safe operation.

SR 3.9.2.2

Performance of a CHANNEL FUNCTIONAL TEST on each channeldemonstrates the associated refuel position one-rod-outinterlock will function properly when a simulated or actualsignal indicative of a required condition is injected intothe logic. The CHANNEL FUNCTIONAL TEST may be performed byany series of sequential, overlapping, or total channelsteps so that the entire channel is tested. The 7 dayFrequency is considered adequate because of demonstratedcircuit reliability, procedural controls on control rodwithdrawals, and visual and audible indications available inthe control room to alert the operator to control rods notfully inserted. To perform the required testing, theapplicable condition must be entered (i.e., a control rodmust be withdrawn from its full-in position). Therefore,SR 3.9.2.2 has been modified by a Note that states theCHANNEL FUNCTIONAL TEST is not required to be performeduntil 1 hour after any control rod is withdrawn.





Control Rod PositionB 3.9.3


B 3.9.3 Control Rod Position

BASES

BACKGROUND Control rods provide the capability to maintain the reactorsubcritical under all conditions and to limit the potentialamount and rate of reactivity increase caused by amalfunction in the Reactor Manual Control System. Duringrefueling, movement of control rods is limited by therefueling interlocks (LCO 3.9.1 and LCO 3.9.2) or thecontrol rod block with the reactor mode switch in theshutdown position (LCO 3.3.2.1).

UFSAR design criteria require that one of the two requiredindependent reactivity control systems be capable of holdingthe reactor core subcritical under cold conditions (Ref. 1).The control rods serve as the system capable of maintainingthe reactor subcritical in cold conditions.

The refueling interlocks allow a single control rod to bewithdrawn at any time unless fuel is being loaded into thecore. To preclude loading fuel assemblies into the corewith a control rod withdrawn, all control rods must be fullyinserted. This prevents the reactor from achievingcriticality during refueling operations.


Prevention and mitigation of prompt reactivity excursionsduring refueling are provided by the refueling interlocks(LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1), the widerange neutron monitor period-short scram (LCO 3.3.1.1), andthe control rod block instrumentation (LCO 3.3.2.1).

The safety analysis for the control rod withdrawal errorduring refueling in the UFSAR (Ref. 2) assumes thefunctioning of the refueling interlocks and adequate SDM.The analysis for the fuel assembly insertion error (Ref. 3)assumes all control rods are fully inserted. Thus, prior tofuel reload, all control rods must be fully inserted tominimize the probability of an inadvertent criticality.

Control rod position satisfies Criterion 3 of the NRC PolicyStatement.

(continued)


Control Rod PositionB 3.9.3

BASES (continued)

LCO All control rods must be fully inserted during applicablerefueling conditions to minimize the probability of aninadvertent criticality during refueling.

APPLICABILITY During MODE 5, loading fuel into core cells with controlrods withdrawn may result in inadvertent criticality.Therefore, the control rods must be inserted before loadingfuel into a core cell. All control rods must be insertedbefore loading fuel to ensure that a fuel loading error doesnot result in loading fuel into a core cell with the controlrod withdrawn.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head ison, and no fuel loading activities are possible. Therefore,this Specification is not applicable in these MODES.

ACTIONS A.1

With all control rods not fully inserted during theapplicable conditions, an inadvertent criticality couldoccur that is not analyzed in the UFSAR. All fuel loadingoperations must be immediately suspended. Suspension ofthese activities shall not preclude completion of movementof a component to a safe position.


During refueling, to ensure that the reactor remainssubcritical, all control rods must be fully inserted priorto and during fuel loading. Periodic checks of the controlrod position ensure this condition is maintained.

The 12 hour Frequency takes into consideration theprocedural controls on control rod movement during refuelingas well as the redundant functions of the refuelinginterlocks.





Control Rod Position IndicationB 3.9.4


B 3.9.4 Control Rod Position Indication

BASES

BACKGROUND The full-in position indication for each control rodprovides necessary information to the refueling interlocksto prevent inadvertent criticalities during refuelingoperations. During refueling, the refueling interlocks(LCO 3.9.1 and LCO 3.9.2) use the full-in positionindication to limit the operation of the refueling equipmentand the movement of the control rods. -The absence of thefull-in position indication signal for any control rodremoves the all-rods-in permissive for the refuelingequipment interlocks and prevents fuel loading. Also, thiscondition causes the refuel position one-rod-out interlockto not allow the withdrawal of any other control rod.

UFSAR design criteria require that one of the two requiredindependent reactivity control systems be capable of holdingthe reactor core subcritical under cold conditions (Ref. 1).The control rods serve as the system capable of maintainingthe reactor subcritical in cold conditions.


Prevention and mitigation of prompt reactivity excursionsduring refueling are provided by the refueling interlocks(LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1), the widerange neutron monitor period-short scram (LCO 3.3.1.1), andthe control rod block instrumentation (LCO 3.3.2.1).

The safety analysis for the control rod withdrawal errorduring refueling (Ref. 2) assumes the functioning of therefueling interlocks and adequate SDM. The analysis for thefuel assembly insertion error (Ref. 3) assumes all controlrods are fully inserted. The full-in position indication isrequired to be OPERABLE so that the refueling interlocks canensure that fuel cannot be loaded with any control rodwithdrawn and that no more than one control rod can bewithdrawn at a time.

Control rod position indication satisfies Criterion 3 of theNRC Policy Statement.

(continued)



BASES (continued)

LCO Each control rod full-in position indication must beOPERABLE to provide the required input to the refuelinginterlocks. A full-in position indication is OPERABLE if itprovides correct position indication to the refuelinginterlock logic.

APPLICABILITY During MODE 5, the control rods must have OPERABLE full-inposition indication to ensure the applicable refuelinginterlocks will be OPERABLE.

In MODES I and 2, requirements for control rod position arespecified in LCO 3.1.3, "Control Rod OPERABILITY." InMODES 3 and 4, with the reactor mode switch in the shutdownposition, a control rod block (LCO 3.3.2.1) ensures allcontrol rods are inserted, thereby preventing criticalityduring shutdown conditions.

ACTIONS A Note has been provided to modify the ACTIONS related tocontrol rod position indication channels. Section 1.3,Completion Times, specifies that once a Condition has beenentered, subsequent divisions, subsystems, components, orvariables expressed in the Condition, discovered to beinoperable or not within limits, will not result in separateentry into the Condition. Section 1.3 also specifies thatRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions forinoperable control rod position indications provideappropriate compensatory measures for separate inoperablechannels. As such, this Note has been provided, whichallows separate Condition entry for each inoperable requiredcontrol rod position indication.

A.I.I. A.1.2. A.1.3. A.2.1 and A.2.2

With one or more required full-in position indicationsinoperable, compensating actions must be taken to protectagainst potential reactivity excursions from fuel assemblyinsertions or control rod withdrawals. This may beaccomplished by immediately suspending invessel fuelmovement and control rod withdrawal, and immediatelyinitiating action to fully insert all insertable controlrods in core cells containing one or more fuel assemblies.

(continued)



BASES

ACTIONS A.1.1, A.1.2. A.1.3. A.2.1 and A.2.2 (continued)

Actions must continue until all insertable control rods incore cells containing one or more fuel assemblies are fullyinserted. Suspension of invessel fuel movements and controlrod withdrawal shall not preclude moving a component to asafe position.

Alternatively, actions must be immediately initiated tofully insert the control rod(s) associated with theinoperable full-in position indicator(s) and disarm(electrically or hydraulically) the drive(s) to ensure thatthe control rod is not withdrawn. A control rod can behydraulically disarmed by closing the drive water andexhaust water isolation valves. A control rod can beelectrically disarmed by disconnecting power from all fourdirection control valve solenoids. Actions must continueuntil all associated control rods are fully inserted anddrives are disarmed. Under these conditions (control rodfully inserted and disarmed), an inoperable full-in positionindication may be bypassed to allow refueling operations toproceed. An alternate method must be used to ensure thecontrol rod is fully inserted (e.g., use the POO" notchposition indication).


The full-in position indications provide input to theone-rod-out interlock and other refueling interlocks thatrequire an all-rods-in permissive. The interlocks areactuated when the full-in position indication for anycontrol rod is not present, since this indicates that allrods are not fully inserted. Therefore, testing of thefull-in position indications is performed to ensure thatwhen a control rod is withdrawn, the full-in positionindication is not present. The full-in position indicationis considered inoperable even with the control rod fullyinserted, if it would continue to indicate full-in with thecontrol rod withdrawn. Performing the SR each time acontrol rod is withdrawn is considered adequate because ofthe procedural controls on control rod withdrawals and thevisual and audible indications available in the control roomto alert the operator to control rods not fully inserted.

(continued)



BASES (continued)





Control Rod OPERABILITY- RefuelingB 3.9.5


B 3.9.5 Control Rod OPERABILITY-Refueling

BASES

BACKGROUND Control rods are components of the Control Rod Drive (CRD)System, the primary reactivity control system for thereactor. In conjunction with the Reactor Protection System,the CRD System provides the means for the reliable controlof reactivity changes during refueling operation. Inaddition, the control rods provide the capability tomaintain the reactor subcritical under-all conditions and tolimit the potential amount and rate of reactivity increasecaused by a malfunction in the CRD System.

UFSAR design criteria require that one of the two requiredindependent reactivity control systems be capable of holdingthe reactor core subcritical under cold conditions (Ref. i).The CRD System is the system capable of maintaining thereactor subcritical in cold conditions.


Prevention and mitigation of prompt reactivity excursionsduring refueling are provided by refueling interlocks(LCO 3.9.1 and LCO 3.9.2), the SDM (LCO 3.1.1), the widerange neutron monitor period-short scram (LCO 3.3.1.1), andthe control rod block instrumentation (LCO 3.3.2.1).

The safety analyses for the control rod withdrawal errorduring refueling (Ref. 2) and the fuel assembly insertionerror (Ref. 3) evaluate the consequences of control rodwithdrawal during refueling and also fuel assembly insertionwith a control rod withdrawn. A prompt reactivity excursionduring refueling could potentially result in fuel failurewith subsequent release of radioactive material to theenvironment. Control rod scram provides protection should aprompt reactivity excursion occur.

Control rod OPERABILITY during refueling satisfiesCriterion 3 of the NRC Policy Statement.

LCO Each withdrawn control rod must be OPERABLE. The withdrawncontrol rod is considered OPERABLE if the scram accumulatorpressure is ; 940 psig and the control rod is capable of

(continued)


Control Rod OPERABILITY-RefuelingB 3.9.5

BASES

LCO being automatically inserted upon receipt of a scram signal.(continued) Inserted control rods have already completed their

reactivity control function, and therefore, are not requiredto be OPERABLE.

APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE toensure that in a scram the control rods will insert andprovide the required negative reactivity to maintain thereactor subcritical.

For MODES 1 and 2, control rod requirements are found inLCO 3.1.2, "Reactivity Anomalies," LCO 3.1.3, "Control RodOPERABILITY," LCO 3.1.4, "Control Rod Scram Times," andLCO 3.1.5, "Control Rod Scram Accumulators." During MODES 3and 4, control rods are not able to be withdrawn since thereactor mode switch is in shutdown and a control rod blockis applied. This provides adequate requirements for controlrod OPERABILITY during these conditions.

ACTIONS A.]

With one or more withdrawn control rods inoperable, actionmust be immediately initiated to fully insert the inoperablecontrol rod(s). Inserting the control rod(s) ensures theshutdown and scram capabilities are not adversely affected.Actions must continue until the inoperable control rod(s) isfully inserted.


During MODE 5, the OPERABILITY of control rods is primarilyrequired to ensure a withdrawn control rod willautomatically insert if a signal requiring a reactorshutdown occurs. Because no explicit analysis exists forautomatic shutdown during refueling, the shutdown functionis satisfied if the withdrawn control rod is capable ofautomatic insertion and the associated CRD scram accumulatorpressure is Ž 940 psig.

The 7 day Frequency takes into consideration equipmentreliability, procedural controls over the scramaccumulators, and control room alarms and indicating lightsthat indicate low accumulator charge pressures.

(continued)


Control Rod OPERABILITY-RefuelingB 3.9.5

BASES


SR 3.9.5.1 is modified by a Note that allows 7 days afterwithdrawal of the control rod to perform the Surveillance.This acknowledges that the control rod must first bewithdrawn before performance of the Surveillance, andtherefore avoids potential conflicts with SR 3.0.3 andSR 3.0.4.





RPV Water LevelB 3.9.6


B 3.9.6 Reactor Pressure Vessel (RPV) Water Level

BASES

BACKGROUND The movement of fuel assemblies or handling of control rodswithin the RPV requires a minimum water level of 458 inchesabove RPV instrument zero. During refueling, this maintainsa sufficient water level in the reactor vessel cavity andspent fuel pool. Sufficient water is necessary to retainiodine fission product activity in the water in the event ofa fuel handling accident (Refs. I and 2). Sufficient iodineactivity would be retained to limit offsite doses from theaccident to well below the guidelines set forth in10 CFR 100 (Ref. 3).


During movement of fuel assemblies or handling of controlrods, the water level in the RPV and the spent fuel pool isan implicit initial condition design parameter in theanalysis of a fuel handling accident in containmentpostulated in Reference 1. A minimum water level of 20 ft11 inches above the top of the RPV flange allows a partitionfactor of 100 to be used in the accident analysis forhalogens (Ref. 1).

Analysis of the fuel handling accident inside containment isdescribed in Reference 1. With a minimum water level of458 inches above RPV instrument zero (20 ft 11 inches abovethe top of the RPV flange) and a minimum decay time of24 hours prior to fuel handling, the analysis and testprograms demonstrate that the iodine release due to apostulated fuel handling accident is adequately captured bythe water and that offsite doses are maintained withinallowable limits (Ref. 3).

While the worst case assumptions include the dropping of anirradiated fuel assembly onto the reactor core, thepossibility exists of the dropped assembly striking the RPVflange and releasing fission products. Therefore, theminimum depth for water coverage to ensure acceptableradiological consequences is specified from the RPV flange.Since the worst case event results in failed fuel assembliesseated in the core, as well as the dropped assembly,

(continued)



BASES

APPLICABLE dropping an assembly on the RPV flange will result inSAFETY ANALYSES reduced releases of fission gases. Based on this judgement,

(continued) and the physical dimensions which preclude normal operationwith water level 23 feet above the flange, a slightreduction in this water level (to 20 ft 11 inches above theflange) is acceptable (Ref. 3).

RPV water level satisfies Criterion 2 of the NRC PolicyStatement.

LCO A minimum water level of 458 inches above RPV instrumentzero (20 ft 11 inches above the top of the RPV flange) isrequired to ensure that the radiological consequences of apostulated fuel handling accident are within acceptablelimits.

APPLICABILITY LCO 3.9.6 is applicable when moving fuel assemblies orhandling control rods (i.e., movement with other than thenormal control rod drive) within the RPV. The LCO minimizesthe possibility of a fuel handling accident in containmentthat is beyond the assumptions of the safety analysis. Ifirradiated fuel is not present within the RPV, there can beno significant radioactivity release as a result of apostulated fuel handling accident. Requirements for fuelhandling accidents in the spent fuel storage pool arecovered by LCO 3.7.7, "Spent Fuel Storage Pool Water Level."

ACTIONS A.1

If the water level is < 458 inches above RPV instrumentzero, all operations involving movement of fuel assembliesand handling of control rods within the RPV shall besuspended immediately to ensure that a fuel handlingaccident cannot occur. The suspension of fuel movement andcontrol rod handling shall not preclude completion ofmovement of a component to a safe position.

(continued)



BASES (continued)


SR 3.9.6.1

Verification of a minimum water level of 458 inches aboveRPV instrument zero ensures that the design basis for thepostulated fuel handling accident analysis during refuelingoperations is met. Water at the required level limits theconsequences of damaged fuel rods, which are postulated toresult from a fuel handling accident in containment(Ref. 1).

The Frequency of 24 hours is based on engineering judgmentand is considered adequate in view of the large volume ofwater and the normal procedural controls on valve positions,which make significant unplanned level changes unlikely.



3. 10 CFR 100.11.


RHR-High Water LevelB 3.9.7


B 3.9.7 Residual Heat Removal (RHR)-High Water Level

BASES

BACKGROUND The purpose of the RHR System in MODE 5 is to remove decayheat and sensible heat from the reactor coolant, as requiredin UFSAR, Section 1.5. The RHR System has two loops witheach loop consisting of two motor driven pumps, two heatexchangers, and associated piping and valves. There are twoRHR shutdown cooling subsystems per RHR System loop. Thefour RHR shutdown cooling subsystems have a common suctionfrom the same recirculation loop. Each pump discharges thereactor coolant, after it has been cooled by circulationthrough the respective heat exchangers, to the reactor viathe associated recirculation loop. The RHR heat exchangerstransfer heat to the High Pressure Service Water System.The RHR shutdown cooling mode is manually controlled. Anyone of the four RHR shutdown cooling subsystems can providethe required decay heat removal function.

In addition to the RHR subsystems, the volume of water abovethe reactor pressure vessel (RPV) flange provides a heatsink for decay heat removal.

APPLICABLE With the unit in MODE 5, the RHR System is not required toSAFETY ANALYSES mitigate any events or accidents evaluated in the safety

analyses. The RHR System is required for removing decayheat to maintain the temperature of the reactor coolant.

The RHR System satisfies Criterion 4 of the NRC PolicyStatement.

LCO Only one RHR shutdown cooling subsystem is required to beOPERABLE and in operation in MODE 5 with irradiated fuel inthe RPV and the water level 2 458 inches above RPVinstrument zero. Only one subsystem is required because thevolume of water above the RPV flange provides backup decayheat removal capability.

An OPERABLE RHR shutdown cooling subsystem consists of anRHR pump, a heat exchanger, a High Pressure Service WaterSystem pump capable of providing cooling to the heatexchanger, valves, piping, instruments, and controls toensure an OPERABLE flow path. In MODE 5, the RHR cross-tie

(continued)



BASES

LCO(continued)

valve is not required to be closed; thus the valve may beopened to allow an RHR pump in one loop to discharge throughthe opposite recirculation loop to make a completesubsystem. In addition, the HPSW cross-tie valve may beopen to allow a HPSW pump in one loop to provide cooling toa heat exchanger in the opposite loop to make a completesubsystem.

Additionally, each RHR shutdown cooling subsystem isconsidered OPERABLE if it can be manually aligned (remote orlocal) in the shutdown cooling mode for removal of decayheat. Operation (either continuous or intermittent) of onesubsystem can maintain and reduce the reactor coolanttemperature as required. However, to ensure adequate coreflow to allow for accurate average reactor coolanttemperature monitoring, nearly continuous operation isrequired. A Note is provided to allow a 2 hour exception toshut down the operating subsystem every 8 hours.

APPLICABILITY One RHR shutdown cooling subsystem must be OPERABLE and inoperation in MODE 5, with irradiated fuel in the RPV and thewater level 2 458 inches above RPV instrument zero (20 ft11 inches above the top of the RPV flange), to provide decayheat removal. RHR shutdown cooling subsystem requirementsin other MODES are covered by LCOs in Section 3.4, ReactorCoolant System (RCS); Section 3.5, Emergency Core CoolingSystems (ECCS) and Reactor Core Isolation Cooling (RCIC)System; and Section 3.6, Containment Systems. RHR ShutdownCooling System requirements in MODE 5 with irradiated fuelin the RPV and the water level < 458 inches above RPVinstrument zero are given in LCO 3.9.8.

ACTIONS A._ I

With no RHR shutdown cooling subsystem OPERABLE, analternate method of decay heat removal must be establishedwithin I hour. In this condition, the volume of water abovethe RPV flange provides adequate capability to remove decayheat from the reactor core. However, the overallreliability is reduced because loss of water level couldresult in reduced decay heat removal capability. The 1 hourCompletion Time is based on decay heat removal function and

(continued)



BASES


the probability of a loss of the available decay heatremoval capabilities. Furthermore, verification of thefunctional availability of these alternate method(s) must bereconfirmed every 24 hours thereafter. This will ensurecontinued heat removal capability.

Alternate decay heat removal methods are available to theoperators for review and preplanning in the unit's OperatingProcedures. For example, this may include the use of theReactor Water Cleanup System, operating with theregenerative heat exchanger bypassed. The method used toremove the decay heat should be the most prudent choicebased on unit conditions.

B.1. B.2. B.3, and B.4

If no RHR shutdown cooling subsystem is OPERABLE and analternate method of decay heat removal is not available inaccordance with Required Action A.1, actions shall be takenimmediately to suspend operations involving an increase inreactor decay heat load by suspending loading of irradiatedfuel assemblies into the RPV.

Additional actions are required to minimize any potentialfission product release to the environment. This includesensuring secondary containment is OPERABLE; one standby gastreatment subsystem for Unit 2 is OPERABLE; and secondarycontainment isolation capability (i.e., one secondarycontainment isolation valve and associated instrumentationare OPERABLE or other acceptable administrative controls toassure isolation capability) in each associated penetrationnot isolated that is assumed to be isolated to mitigateradioactive releases. This may be performed as anadministrative check, by examining logs or other informationto determine whether the components are out of service formaintenance or other reasons. It is not necessary toperform the Surveillances needed to demonstrate theOPERABILITY of the components. If, however, any requiredcomponent is inoperable, then it must be restored toOPERABLE status. In this case, a surveillance may need tobe performed to restore the component to OPERABLE status.Actions must continue until all required components areOPERABLE.

(continued)



BASES


If no RHR shutdown cooling subsystem is in operation, analternate method of coolant circulation is required to beestablished within I hour. This alternate method mayutilize forced or natural circulation cooling. TheCompletion Time is modified such that the 1 hour isapplicable separately for each occurrence involving a lossof coolant circulation.

During the period when the reactor coolant is beingcirculated by an alternate method (other than by therequired RHR shutdown cooling subsystem), the reactorcoolant temperature must be periodically monitored to ensureproper functioning of the alternate method. The once perhour Completion Time is deemed appropriate.


This Surveillance demonstrates that the RHR shutdown coolingsubsystem is in operation and circulating reactor coolant.

The required flow rate is determined by the flow ratenecessary to provide sufficient decay heat removalcapability. The Frequency of 12 hours is sufficient in viewof other visual and audible indications available to theoperator for monitoring the RHR shutdown cooling subsystemin the control room.

REFERENCES None.


RHR-Low Water LevelB 3.9.8


B 3.9.8 Residual Heat Removal (RHR).-Low Water Level

BASES

BACKGROUND The purpose of the RHR System in MODE 5 is to remove decayheat and sensible heat from the reactor coolant, as requiredin UFSAR Section 1.5. The RHR System has two loops witheach loop consisting of two motor driven pumps, two heatexchangers, and associated piping and valves. There are twoRHR shutdown cooling subsystems per RHR System loop. Thefour RHR shutdown cooling subsystems have a common suctionfrom the same recirculation loop. Each pump discharges thereactor coolant, after it has been cooled by circulationthrough the respective heat exchangers, to the reactor viathe associated recirculation loop. The RHR heat exchangerstransfer heat to the High Pressure Service Water System.The RHR shutdown cooling mode is manually controlled. Anyone of the four RHR shutdown cooling subsystems can providethe required decay heat removal function.

APPLICABLE With the unit in MODE 5, the RHR System is not required toSAFETY ANALYSES mitigate any events or accidents evaluated in the safety

analyses. The RHR System is required for removing decayheat to maintain the temperature of the reactor coolant.

The RHR System satisfies Criterion 4 of the NRC PolicyStatement.

LCO In MODE 5 with irradiated fuel in the RPV and the waterlevel < 458 inches above reactor pressure vessel (RPV)instrument zero both RHR shutdown cooling subsystems must beOPERABLE.

An OPERABLE RHR shutdown cooling subsystem consists of anRHR pump, a heat exchanger, a High Pressure Service WaterSystem pump capable of providing cooling to the heatexchanger, valves, piping, instruments, and controls toensure an OPERABLE flow path. The two subsystems have acommon suction source and are allowed to have commondischarge piping. Since piping is a passive component thatis assumed not to fail, it is allowed to be common to bothsubsystems. In MODE 5, the RHR cross-tie valve is notrequired to be closed, thus the valve may be opened to allow

(continued)



BASES

LCO(continued)

an RHR pump in one loop to discharge through the oppositerecirculation loop to make a complete subsystem. Inaddition, the HPSW cross-tie valve may be open to allow aHPSW pump in one loop to provide cooling to a heat exchangerin the opposite loop to make a complete subsystem.

Additionally, each RHR shutdown cooling subsystem isconsidered OPERABLE if it can be manually aligned (remote orlocal) in the shutdown cooling mode for removal of decayheat. Operation (either continuous or intermittent) of onesubsystem can maintain and reduce the reactor coolanttemperature as required. However, to ensure adequate coreflow to allow for accurate average reactor coolanttemperature monitoring, nearly continuous operation isrequired. A Note is provided to allow a 2 hour exception toshut down the operating subsystem every 8 hours.

APPLICABILITY Two RHR shutdown cooling subsystems are required to beOPERABLE, and one must be in operation in MODE 5, withirradiated fuel in the RPV and the water level < 458 inchesabove RPV instrument zero (20 ft 11 inches above the top ofthe RPV flange), to provide decay heat removal. RHRshutdown cooling subsystem requirements in other MODES arecovered by LCOs in Section 3.4, Reactor Coolant System(RCS); Section 3.5, Emergency Core Cooling Systems (ECCS)and Reactor Core Isolation Cooling (RCIC) System; andSection 3.6, Containment Systems. RHR Shutdown CoolingSystem requirements in MODE 5 with irradiated fuel in theRPV and the water level ; 458 inches above RPV instrumentzero are given in LCO 3.9.7, "Residual Heat Removal(RHR)--High Water Level.'

ACTIONS A. I

With one of the two required RHR shutdown cooling subsystemsinoperable, the remaining subsystem is capable of providingthe required decay heat removal. However, the overallreliability is reduced. Therefore an alternate method ofdecay heat removal must be provided. With both required RHRshutdown cooling subsystems inoperable, an alternate methodof decay heat removal must be provided in addition to thatprovided for the initial RHR shutdown cooling subsysteminoperability. This re-establishes backup decay heatremoval capabilities, similar to the requirements of the

(continued)



BASES

ACTIONS A.1_ (continued)

LCO. The I hour Completion Time is based on the decay heatremoval function and the probability of a loss of theavailable decay heat removal capabilities. Furthermore,verification of the functional availability of thisalternate method(s) must be reconfirmed every 24 hoursthereafter. This will ensure continued heat removalcapability.

Alternate decay heat removal methods are available to theoperators for review and preplanning in the unit's OperatingProcedures. For example, this may include the use of theReactor Water Cleanup System, operating with theregenerative heat exchanger bypassed. The method used toremove decay heat should be the most prudent choice based onunit conditions.

B.1. B.2, and B.3

With the required decay heat removal subsystem(s) inoperableand the required alternate method(s) of decay heat removalnot available in accordance with Required Action A.1,additional actions are required to minimize any potentialfission product release to the environment. This includesensuring secondary containment is OPERABLE; one standby gastreatment subsystem for Unit 2 is OPERABLE; and secondarycontainment isolation capability (i.e., one secondarycontainment isolation valve and associated instrumentationare OPERABLE or other acceptable administrative controls toassure isolation capability) in each associated penetrationthat is assumed to be isolated to mitigate radioactivereleases. This may be performed as an administrative check,by examining logs or other information to determine whetherthe components are out of service for maintenance or otherreasons. It is not necessary to perform the Surveillancesneeded to demonstrate the OPERABILITY of the components.If, however, any required component is inoperable, then itmust be restored to OPERABLE status. In this case, thesurveillance may need to be performed to restore thecomponent to OPERABLE status. Actions must continue untilall required components are OPERABLE.

(continued)

PBAPS UNIT 2 B -3.9-26 Revision No. 0


BASES 0ACTIONS

(continued)C.] and C.2

If no RHR shutdown cooling subsystem is in operation, analternate method of coolant circulation is required to beestablished within I hour. This alternate method mayutilize forced or natural circulation cooling. TheCompletion Time is modified such that the I hour isapplicable separately for each occurrence involving a lossof-coolant circulation.

During the period when the reactor coolant is beingcirculated by an alternate method (other than by therequired RHR shutdown cooling subsystem), the reactorcoolant temperature must be periodically monitored to ensureproper functioning of the alternate method. The once perhour Completion Time is deemed appropriate.


SR 3.9.8.1

This Surveillance demonstrates that one RHR shutdown coolingsubsystem is in operation and circulating reactor coolant.The required flow rate is determined by the flow ratenecessary to provide sufficient decay heat removalcapability.

The Frequency of 12 hours is sufficient in view of othervisual and audible indications available to the operator formonitoring the RHR shutdown cooling subsystems in thecontrol room.

REFERENCES None.


Inservice Leak and Hydrostatic Testing OperationB 3.10.1


B 3.10.1 Inservice Leak and Hydrostatic Testing Operation

BASES

BACKGROUND The purpose of this Special Operations LCO is to allowcertain reactor coolant pressure tests to be performed inMODE 4 when the metallurgical characteristics of the reactorpressure vessel (RPV) or plant temperature controlcapabilities during these tests require the pressure testingat temperatures > 212°F (normally corresponding to MODE 3).

Inservice hydrostatic testing and system leakage pressuretests required by Section XI of the American Society ofMechanical Engineers (ASME) Boiler and Pressure Vessel Code(Ref. 1) are performed prior to the reactor going criticalafter a refueling outage. Recirculation pump operation anda water solid RPV (except for an air bubble for pressurecontrol) are used to achieve the necessary temperatures andpressures required for these tests. The minimumtemperatures (at the required pressures) allowed for thesetests are determined from the RPV pressure and temperature(P/T) limits required by LCO 3.4.9, "Reactor Coolant System(RCS) Pressure and Temperature (P/T) Limits." These limitsare conservatively based on the fracture toughness of thereactor vessel, taking into account anticipated vesselneutron fluence.

With increased reactor vessel fluence over time, the minimumallowable vessel temperature increases at a given pressure.Periodic updates to the RCS P/T limit curves are performedas necessary, based upon the results of analyses ofirradiated surveillance specimens removed from the vessel.Hydrostatic and leak testing may eventually be required withminimum reactor coolant temperatures > 212°F.


Allowing the reactor to be considered in MODE 4 duringhydrostatic or leak testing, when the reactor coolanttemperature is > 2120F, effectively provides an exception toMODE 3 requirements, including OPERABILITY of primarycontainment and the full complement of redundant EmergencyCore Cooling Systems. Since the hydrostatic or leak testsare performed nearly water solid (except for an air bubblefor pressure control), at low decay heat values, and nearMODE 4 conditions, the stored energy in the reactor corewill be very low. Under these conditions, the potential for

(continued)



BASES


(continued)

failed fuel and a subsequent increase in coolant activityabove the LCO 3.4.6, "RCS Specific Activity," limits areminimized. In addition, the secondary containment will beOPERABLE, in accordance with this Special Operations LCO,and will be capable of handling any airborne radioactivityor steam leaks that could occur during the performance ofhydrostatic or leak testing. The required pressure testingconditions provide adequate assurance that the consequencesof-a steam leak will be conservatively bounded by theconsequences of the postulated main steam line break outsideof primary containment described in Reference 2. Therefore,these requirements will conservatively limit radiationreleases to the environment.

In the event of a large primary system leak, the reactorvessel would rapidly depressurize, allowing the low pressurecore cooling systems to operate. The capability of the lowpressure coolant injection and core spray subsystems, asrequired in MODE 4 by LCO 3.5.2, "ECCS--Shutdown," would bemore than adequate to keep the core flooded under this lowdecay heat load condition. Small system leaks would bedetected by leakage inspections before significant inventoryloss occurred.

For the purposes of this test, the protection provided bynormally required MODE 4 applicable LCOs, in addition to thesecondary containment requirements required to be met bythis Special Operations LCO, will ensure acceptableconsequences during normal hydrostatic test conditions andduring postulated accident conditions.

As described in LCO 3.0.7, compliance with SpecialOperations LCOs is optional, and therefore, no criteria ofthe NRC Policy Statement apply. Special Operations LCOsprovide flexibility to perform certain operations byappropriately modifying requirements of other LCOs. Adiscussion of the criteria satisfied for the other LCOs isprovided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. Operation at reactor coolanttemperatures > 212"F can be in accordance with Table 1.1-1for MODE 3 operation without meeting this Special OperationsLCO or its ACTIONS. This option may be required due to P/T

(continued)

PBAPS UNIT 2 B 3.1I0-2 Revision No. 0


BASES

LCO(continued)

limits, however, which require testing at temperatures> 212°F, while the ASME inservice test itself requires thesafety/relief valves to be gagged, preventing theirOPERABILITY.

If it is desired to perform these tests while complying withthis Special Operations LCO, then the MODE 4 applicable LCOsand specified MODE 3 LCOs must be met. This SpecialOperations LCO allows changing Table 1.1-1 temperaturelimits for MODE 4 to "NA" and suspending the requirements ofLCO 3.4.8, "Residual Heat Removal (RHR) Shutdown CoolingSystem-Cold Shutdown." The additional requirements forsecondary containment LCOs to be met will provide sufficientprotection for operations at reactor coolant temperatures> 212°F for the purpose of performing either an inserviceleak or hydrostatic test.

This LCO allows primary containment to be open for frequentunobstructed access to perform inspections, and for outageactivities on various systems to continue consistent withthe MODE 4 applicable requirements that are in effectimmediately prior to and immediately after this operation.

APPLICABILITY The MODE 4 requirements may only be modified for theperformance of inservice leak or hydrostatic tests so thatthese operations can be considered as in MODE 4, even thoughthe reactor coolant temperature is > 212°F. The additionalrequirement for secondary containment OPERABILITY accordingto the imposed MODE 3 requirements provides conservatism inthe response of the unit to any event that may occur.Operations in all other MODES are unaffected by this LCO.

ACTIONS A Note has been provided to modify the ACTIONS related toinservice leak and hydrostatic testing operation.Section 1.3, Completion Times, specifies that once aCondition has been entered, subsequent divisions,subsystems, components, or variables expressed in theCondition discovered to be inoperable or not within limits,will not result in separate entry into the Condition.Section 1.3 also specifies that Required Actions of theCondition continue to apply for each additional failure,with Completion Times based on initial entry into theCondition. However, the Required Actions for eachrequirement of the LCO not met provide appropriate

(continued)



BASES

ACTIONS(continued)

compensatory measures for separate requirements that arenot met. As such, a Note has been provided that allowsseparate Condition entry for each requirement of the LCO.

A.1_

If an LCO specified in LCO 3.10.1 is not met, the ACTIONSapplicable to the stated requirements are enteredimmediately and complied with. Required Action A.1 has beenmodified by a Note that clarifies the intent of anotherLCO's Required Action to be in MODE 4 includes reducing theaverage reactor coolant temperature to : 212"F.

A.2.1 and A.2.2

Required Action A.2.1 and Required Action A.2.2 arealternate Required Actions that can be taken instead ofRequired Action A.1 to restore compliance with the normalMODE 4 requirements, and thereby exit this Special OperationLCO's Applicability. Activities that could further increasereactor coolant temperature or pressure are suspendedimmediately, in accordance with Required Action A.2.1, andthe reactor coolant temperature is reduced to establishnormal MODE 4 requirements. The allowed Completion Time of24 hours for Required Action A.2.2 is based on engineeringjudgment and provides sufficient time to reduce the averagereactor coolant temperature from the highest expected valueto : 212"F with normal cooldown procedures. The CompletionTime is also consistent with the time provided in LCO 3.0.3to reach MODE 4 from MODE 3.


The LCOs made applicable are required to have theirSurveillances met to establish that this LCO is being met.A discussion of the applicable SRs is provided in theirrespective Bases.

REFERENCES 1. American Society of Mechanical Engineers, Boiler and

Pressure Vessel Code, Section XI.



Reactor Mode Switch Interlock TestingB 3.10.2


B 3.10.2 Reactor Mode Switch Interlock Testing

BASES

BACKGROUND The purpose of this Special Operations LCO is to permitoperation of the reactor mode switch from one position toanother to confirm certain aspects of associated interlocksduring periodic tests and calibrations in MODES 3, 4, and 5.

The reactor mode switch is a conveniently located,multiposition, keylock switch provided to select thenecessary scram functions for various plant conditions(Ref. 1). The reactor mode switch selects the appropriatetrip relays for scram functions and provides appropriatebypasses. The mode switch positions and related scraminterlock functions are summarized as follows:

a. Shutdown-Initiates a reactor scram; bypasses mainsteam line isolation and main condenser low vacuumscrams;

b. Refuel -Selects Neutron Monitoring System (NMS) scramfunction for low neutron flux level operation (widerange neutron monitors and average power range monitorsetdown scram); bypasses main steam line isolation andmain condenser low vacuum scrams;

c. Startup/Hot Standby-Selects NMS scram function for lowneutron flux level operation (wide range neutronmonitors and average power range monitors); bypassesmain steam line isolation and main condenser lowvacuum scrams; and

d. Run-Selects NMS scram function for power rangeoperation.

The reactor mode switch also provides interlocks for suchfunctions as control rod blocks, scram discharge volume tripbypass, refueling interlocks, and main steam isolation valveisolations.

APPLICABLE The acceptance criterion for reactor mode switch interlockSAFETY ANALYSES testing is to prevent fuel failure by precluding reactivity

excursions or core criticality. The interlock functions of

(continued)



BASES

0APPLICABLESAFETY ANALYSES

(continued)

the shutdown and refuel positions normally maintained forthe reactor mode switch in MODES 3, 4, and 5 are provided topreclude reactivity excursions that could potentially resultin fuel failure. Interlock testing that requires moving thereactor mode switch to other positions (run, startup/hotstandby, or refuel) while in MODE 3, 4, or 5, requiresadministratively maintaining all control rods inserted andno other CORE ALTERATIONS in progress. With all controlrods inserted in core cells containing one or more fuelassemblies, and no CORE ALTERATIONS in progress, there areno credible mechanisms for unacceptable reactivityexcursions during the planned interlock testing.

For postulated accidents, such as control rod removal errorduring refueling or loading of fuel with a control rodwithdrawn, the accident analysis demonstrates that fuelfailure will not occur (Refs. 2 and 3). The withdrawal of asingle control rod will not result in criticality whenadequate SDM is maintained. Also, loading fuel assembliesinto the core with a single control rod withdrawn will notresult in criticality, thereby preventing fuel failure.


LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. MODES 3, 4, and 5 operationsnot specified in Table 1.1-1 can be performed in accordancewith other Special Operations LCOs (i.e., LCO 3.10.1,"Inservice Leak and Hydrostatic Testing Operation,"LCO 3.10.3, "Single Control Rod Withdrawal-Hot Shutdown,"LCO 3.10.4, "Single Control Rod Withdrawal-Cold Shutdown,"and LCO 3.10.8, "SDM Test-Refueling") without meeting thisLCO or its ACTIONS. If any testing is performed thatinvolves the reactor mode switch interlocks and requiresrepositioning beyond that specified in Table 1.1-1 for thecurrent MODE of operation, the testing can be performed,provided all interlock functions potentially defeated areadministratively controlled. In MODES 3, 4, and 5 with thereactor mode switch in shutdown as specified in Table 1.1-1,all control rods are fully inserted and a control rod block

(continued)



BASES

LCO(continued)

is initiated. Therefore, all control rods in core cellsthat contain one or more fuel assemblies must be verifiedfully inserted while in MODES 3, 4, and 5, with the reactormode switch in other than the shutdown position. Theadditional LCO requirement to preclude CORE ALTERATIONS isappropriate for MODE 5 operations, as discussed below, andis inherently met in MODES 3 and 4 by the definition of COREALTERATIONS, which cannot be performed with the vessel headin-place.

In MODE 5, with the reactor mode switch in the refuelposition, only one control rod can be withdrawn under therefuel position one-rod-out interlock (LCO 3.9.2, "RefuelPosition One-Rod-Out Interlock"). The refueling equipmentinterlocks (LCO 3.9.1, "Refueling Equipment Interlocks")appropriately control other CORE ALTERATIONS. Due to theincreased potential for error in controlling these multipleinterlocks, and the limited duration of tests involving thereactor mode switch position, conservative controls arerequired, consistent with MODES 3 and 4. The additionalcontrols of administratively not permitting other COREALTERATIONS will adequately ensure that the reactor does notbecome critical during these tests.

APPLICABILITY Any required periodic interlock testing involving thereactor mode switch, while in MODES 1 and 2, can beperformed without the need for Special Operationsexceptions. Mode switch manipulations in these MODES wouldlikely result in unit trips. In MODES 3, 4, and 5, thisSpecial Operations LCO is only permitted to be used to allowreactor mode switch interlock testing that cannotconveniently be performed without this allowance or testingwhich must be performed prior to entering another MODE.Such interlock testing may consist of requiredSurveillances, or may be the result of maintenance, repair,or troubleshooting activities. In MODES 3, 4, and 5, theinterlock functions provided by the reactor mode switch inshutdown (i.e., all control rods inserted and incapable ofwithdrawal) and refueling (i.e., refueling interlocks toprevent inadvertent criticality during CORE ALTERATIONS)positions can be administratively controlled adequatelyduring the performance of certain tests.

(continued)



BASES (continued)

ACTIONS A.1. A.2. A.3.1, and A.3.2

These Required Actions are provided to restore compliancewith the Technical Specifications overridden by this SpecialOperations LCO. Restoring compliance will also result inexiting the Applicability of this Special Operations LCO.

All CORE ALTERATIONS except control rod insertion, if inprogress, are immediately suspended in accordance withRequired Action A.1, and all insertable control rods in corecells that contain one or more fuel assemblies are fullyinserted within 1 hour, in accordance with RequiredAction A.2. This will preclude potential mechanisms thatcould lead to criticality. Suspension of CORE ALTERATIONSshall not preclude the completion of movement of a componentto a safe condition. Placing the reactor mode switch in theshutdown position will ensure that all inserted control rodsremain inserted and result in operating in accordance withTable 1.1-1. Alternatively, if in MODE 5, the reactor modeswitch may be placed in the refuel position, which will alsoresult in operating in accordance with Table 1.1-1. A Noteis added to Required Action A.3.2 to indicate that thisRequired Action is only applicable in MODE 5, since only theshutdown position is allowed in MODES 3 and 4. The allowedCompletion Time of 1 hour for Required Action A.2, RequiredAction A.3.1, and Required Action A.3.2 provides sufficienttime to normally insert the control rods and place thereactor mode switch in the required position, based onoperating experience, and is acceptable given that alloperations that could increase core reactivity have beensuspended.


Meeting the requirements of this Special Operations LCOmaintains operation consistent with or conservative tooperating with the reactor mode switch in the shutdownposition (or the refuel position for MODE 5). The functionsof the reactor mode switch interlocks that are not ineffect, due to the testing in progress, are adequatelycompensated for by the Special Operations LCO requirements.The administrative controls are to be periodically verifiedto ensure that the operational requirements continue to bemet. The Surveillances performed at the 12 hour and 24 hour

(continued)



BASES


SR 3.10.2.1 and SR 3.10.2.2 (continued)

Frequencies are intended to provide appropriate assurancethat each operating shift is aware of and verifiescompliance with these Special Operations LCO requirements.





Single Control Rod Withdrawal--Hot


B 3.10.3 Single Control Rod Withdrawal-Hot Shutdown

BASES

ShutdownB 3.10.3

BACKGROUND The purpose of this MODE 3 Special Operations LCO is topermit the withdrawal of a single control rod for testingwhile in hot shutdown, by imposing certain restrictions. InMODE 3, the reactor mode switch is in the shutdown position,and all control rods are inserted and blocked fromwithdrawal. Many systems and functions are not required inthese conditions, due to the other installed interlocks thatare actuated when the reactor mode switch is in the shutdownposition. However, circumstances may arise while in MODE 3that present the need to withdraw a single control rod forvarious tests (e.g., friction tests, scram timing, andcoupling integrity checks). These single control rodwithdrawals are normally accomplished by selecting therefuel position for the reactor mode switch. This SpecialOperations LCO provides the appropriate additional controlsto allow a single control rod withdrawal in MODE 3.


With the reactor mode switch in the refuel position, theanalyses for control rod withdrawal during refueling areapplicable and, provided the assumptions of these analysesare satisfied in MODE 3, these analyses will bound theconsequences of an accident. Explicit safety analyses inthe UFSAR (Refs. I and 2) demonstrate that the functioningof the refueling interlocks and adequate SDM will precludeunacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rodsto reinforce operational procedures that prevent the reactorfrom becoming critical. These interlocks prevent thewithdrawal of more than one control rod. Under theseconditions, since only one control rod can be withdrawn, thecore will always be shut down even with the highest worthcontrol rod withdrawn if adequate SDM exists.

The control rod scram function provides backup protectionnormal refueling procedures and the refueling interlocks,which prevent inadvertent criticalities during refueling.

to

(continued)


Single Control Rod Withdrawal-Hot ShutdownB 3.10.3

BASES

APPLICABLE Alternate backup protection can be obtained by ensuringSAFETY ANALYSES that five by five array of control rods, centered on the

(continued) withdrawn control rod, are inserted and incapable ofwithdrawal.


LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. Operation in MODE 3 with thereactor mode switch in the refuel position can be performedin accordance with other Special Operations LCOs (i.e.,LCO 3.10.2, "Reactor Mode Switch Interlock Testing") withoutmeeting this Special Operations LCO or its ACTIONS.However, if a single control rod withdrawal is desired inMODE 3, controls consistent with those required duringrefueling must be implemented and this Special OperationsLCO applied. "Withdrawal," in this application, includesthe actual withdrawal of the control rod, as well asmaintaining the control rod in a position other than thefull-in position, and reinserting the control rod. Therefueling interlocks of LCO 3.9.2, "Refuel PositionOne-Rod-Out Interlock," required by this Special OperationsLCO, will ensure that only one control rod can be withdrawn.

To back up the refueling interlocks (LCO 3.9.2), the abilityto scram the withdrawn control rod in the event of aninadvertent criticality is provided by this SpecialOperations LCO's requirements in Item d.1. Alternately,provided a sufficient number of control rods in the vicinityof the withdrawn control rod are known to be inserted andincapable of withdrawal, Item d.2, the possibility ofcriticality on withdrawal of this control rod issufficiently precluded, so as not to require the scramcapability of the withdrawn control rod. Also, once thisalternate (d.2) is completed, the SDM requirement to accountfor both the withdrawn untrippable (inoperable) control rod,and the highest worth control rod may be changed to allowthe withdrawn untrippable (inoperable) control rod to be thesingle highest worth control rod.

(continued)


Single Control Rod Withdrawal--Hot ShutdownB 3.10.3

BASES (continued)

APPLICABILITY Control rod withdrawals are adequately controlled inMODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4,control rod withdrawal is only allowed if performed inaccordance with this Special Operations LCO or SpecialOperations LCO 3.10.4, and if limited to one control rod.This allowance is only provided with the reactor mode switchin the refuel position. For these conditions, theone-rod-out interlock (LCO 3.9.2), control rod positionindication (LCO 3.9.4, "Control Rod Position Indication"),full insertion requirements for all other control rods andscram functions (LCO 3.3.1.1, "Reactor Protection System(RPS) Instrumentation," and LCO 3.9.5, Control RodOPERABILITY-Refueling"), or the added administrativecontrols in Item d.2 of this Special Operations LCO,minimize potential reactivity excursions.

ACTIONS A Note has been provided to modify the ACTIONS related to asingle control rod withdrawal while in MODE 3. Section 1.3,Completion Times, specifies once a Condition has beenentered, subsequent divisions, subsystems, components orvariables expressed in the Condition discovered to beinoperable or not within limits, will not result in separateentry into the Condition. Section 1.3 also specifiesRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions foreach requirement of the LCO not met provide appropriatecompensatory measures for separate requirements that are notmet. As such, a Note has been provided that allows separateCondition entry for each requirement of the LCO.

A.1

If one or more of the requirements specified in this SpecialOperations LCO are not met, the ACTIONS applicable to thestated requirements of the affected LCOs are immediatelyentered as directed by Required Action A.I. RequiredAction A.1 has been modified by a Note that clarifies theintent of any other LCO's Required Action to insert allcontrol rods. This Required Action includes exiting thisSpecial Operations Applicability by returning the reactormode switch to the shutdown position. A second Note hasbeen added, which clarifies that this Required Action isonly applicable if the requirements not met are for anaffected LCO.

(continued)


Single Control Rod Withdrawal-Hot ShutdownB 3.10.3

BASES

ACTIONS A.2.I and A.2.2(continued)

Required Actions A.2.1 and A.2.2 are alternate RequiredActions that can be taken instead of Required Action A.1 torestore compliance with the normal MODE 3 requirements,thereby exiting this Special Operations LCO's Applicability.Actions must be initiated immediately to insert allinsertable control rods. Actions must continue until allsuch control rods are fully inserted. Placing the reactormode switch in the shutdown position will ensure allinserted rods remain inserted and restore operation inaccordance with Table 1.1-1. The allowed Completion Time of1 hour to place the reactor mode switch in the shutdownposition provides sufficient time to normally insert thecontrol rods.

SURVEILLANCE SR 3.10.3.1. SR 3.10.3.2, and SR 3.10.3.3REQUIREMENTS

The other LCOs made applicable in this Special OperationsLCO are required to have their Surveillances met toestablish that this Special Operations LCO is being met. Ifthe local array of control rods is inserted and disarmedwhile the scram function for the withdrawn rod is notavailable, periodic verification in accordance withSR 3.10.3.2 is required to preclude the possibility ofcriticality. SR 3.10.3.2 has been modified by a Note, whichclarifies that this SR is not required to be met ifSR 3.10.3.1 is satisfied for LCO 3.10.3.d.1 requirements,since SR 3.10.3.2 demonstrates that the alternativeLCO 3.10.3.d.2 requirements are satisfied. Also,SR 3.10.3.3 verifies that all control rods other than thecontrol rod being withdrawn are fully inserted. The 24 hourFrequency is acceptable because of the administrativecontrols on control rod withdrawal, the protection affordedby the LCOs involved, and hardwire interlocks that precludeadditional control rod withdrawals.




Single Control Rod Withdrawal--Cold ShutdownB 3.10.4


B 3.10.4 Single Control Rod Withdrawal-Cold Shutdown

BASES

BACKGROUND The purpose of this MODE 4 Special Operations LCO is topermit the withdrawal of a single control rod for testing ormaintenance, while in cold shutdown, by imposing certainrestrictions. In MODE 4, the reactor mode switch is in theshutdown position, and all control rods are inserted andblocked from withdrawal. Many systems and functions are notrequired in these conditions, due to the installedinterlocks associated with the reactor mode switch in theshutdown position. Circumstances may arise while in MODE 4,however, that present the need to withdraw a single controlrod for various tests (e.g., friction tests, scram timetesting, and coupling integrity checks). Certain situationsmay also require the removal of the associated control roddrive (CRD). These single control rod withdrawals andpossible subsequent removals are normally accomplished byselecting the refuel position for the reactor mode switch.


With the reactor mode switch in the refuel position, theanalyses for control rod withdrawal during refueling areapplicable and, provided the assumptions of these analysesare satisfied in MODE 4, these analyses will bound theconsequences of an accident. Explicit safety analyses inthe UFSAR (Refs. 1 and 2) demonstrate that the functioningof the refueling interlocks and adequate SDM will precludeunacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rodsto reinforce operational procedures that prevent the reactorfrom becoming critical. These interlocks prevent thewithdrawal of more than one control rod. Under theseconditions, since only one control rod can be withdrawn, thecore will always be shut down even with the highest worthcontrol rod withdrawn if adequate SDM exists.

The control rod scram function provides backup protection inthe event of normal refueling procedures and the refuelinginterlocks fail to prevent inadvertent criticalities duringrefueling. Alternate backup protection can be obtained byensuring that a five by five array of control rods, centeredon the withdrawn control rod, are inserted and incapable of

(continued)


Single Control Rod Withdrawal-Cold ShutdownB 3.10.4

BASES

APPLICABLE withdrawal. This alternate backup protection is requiredSAFETY ANALYSES when removing a CRD because this removal renders the

(continued) withdrawn control rod incapable of being scrammed.


LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. Operation in MODE 4 with thereactor mode switch in the refuel position can be performedin accordance with other LCOs (i.e., Special OperationsLCO 3.10.2, "Reactor Mode Switch Interlock Testing") withoutmeeting this Special Operations LCO or its ACTIONS. If asingle control rod withdrawal is desired in MODE 4, controlsconsistent with those required during refueling must beimplemented and this Special Operations LCO applied."Withdrawal," in this application, includes the actualwithdrawal of the control rod, as well as maintaining thecontrol rod in a position other than the full-in position,and reinserting the control rod.

The refueling interlocks of LCO 3.9.2, "Refuel PositionOne-Rod-Out Interlock," required by this Special OperationsLCO will ensure that only one control rod can be withdrawn.At the time CRD removal begins, the disconnection of theposition indication probe will cause LCO 3.9.4, "Control RodPosition Indication," and therefore, LCO 3.9.2 to fail to bemet. Therefore, prior to commencing CRD removal, a controlrod withdrawal block is required to be inserted to ensurethat no additional control rods can be withdrawn and thatcompliance with this Special Operations LCO is maintained.

To back up the refueling interlocks (LCO 3.9.2) or thecontrol rod withdrawal block, the ability to scram thewithdrawn control rod in the event of an inadvertentcriticality is provided by the Special Operations LCOrequirements in Item c.1. Alternatively, when the scram

(continued)



BASES

ACTIONS A.I. A.2.1. and A.2.2(continued)

If one or more of the requirements of this SpecialOperations LCO are not met with the affected control rodinsertable, these Required Actions restore operationconsistent with normal MODE 4 conditions (i.e., all rodsinserted) or with the exceptions allowed in this SpecialOperations LCO. Required Action A.1 has been modified by aNote that clarifies that the intent of any other LCO'sRequired Action is to insert all control rods. ThisRequired Action includes exiting this Special OperationsApplicability by returning the reactor mode switch to theshutdown position. A second Note has been added to RequiredAction A.1 to clarify that this Required Action is onlyapplicable if the requirements not met are for an affectedLCO.

Required Actions A.2.1 and A.2.2 are specified, based on theassumption that the control rod is being withdrawn. If thecontrol rod is still insertable, actions must be immediatelyinitiated to fully insert all insertable control rods andwithin 1 hour place the reactor mode switch in the shutdownposition. Actions must continue until all such control rodsare fully inserted. The allowed Completion Time of I hourfor placing the reactor mode switch in the shutdown positionprovides sufficient time to normally insert the controlrods.

B.]. B.2.1. and B.2.2

If one or more of the requirements of this SpecialOperations*LCO are not met with the affected control rod notinsertable, withdrawal of the control rod and removal of theassociated CRD must be immediately suspended. If the CRDhas been removed, such that the control rod is notinsertable, the Required Actions require the mostexpeditious action be taken to either initiate action torestore the CRD and insert its control rod, or initiateaction to restore compliance with this Special OperationsLCO.

(continued)



BASES (continued)

SURVEILLANCE SR 3.10.4.1. SR 3.10.4.2, SR 3.10.4.3, and SR 3.10.4.4REQUIREMENTS

The other LCOs made applicable by this Special OperationsLCO are required to have their associated surveillances metto establish that this Special Operations LCO is being met.If the local array of control rods is inserted and disarmedwhile the scram function for the withdrawn rod is notavailable, periodic verification is required to ensure thatthe possibility of criticality remains precluded.Verification that all the other control rods are fullyinserted is required to meet the SDM requirements.Verification that a control rod withdrawal block has beeninserted ensures that no other control rods can beinadvertently withdrawn under conditions when positionindication instrumentation is inoperable for the affectedcontrol rod. The 24 hour Frequency is acceptable because ofthe administrative controls on control rod withdrawals, theprotection afforded by the LCOs involved, and hardwireinterlocks to preclude an additional control rod withdrawal.

SR 3.10.4.2 and SR 3.10.4.4 have been modified by Notes,which clarify that these SRs are not required to be met ifthe alternative requirements demonstrated by SR 3.10.4.1 aresatisfied.





BASES

LCO(continued)

function is not OPERABLE, or when the CRD is to be removed,a sufficient number of rods in the vicinity of the withdrawncontrol rod are required to be inserted and made incapableof withdrawal (Item c.2). This precludes the possibility ofcriticality upon withdrawal of this control rod. Also, oncethis alternate (Item c.2) is completed, the SDM requirementto account for both the withdrawn untrippable (inoperable)control rod, and the highest worth control rod may bechanged to allow the withdrawn untrippable (inoperable)control rod to be the single highest worth control rod.

APPLICABILITY Control rod withdrawals are adequately controlled inMODES 1, 2, and 5 by existing LCOs. In MODES 3 and 4,control rod withdrawal is only allowed if performed inaccordance with Special Operations LCO 3.10.3, or thisSpecial Operations LCO, and if limited to one control rod.This allowance is only provided with the reactor mode switchin the refuel position.

During these conditions, the full insertion requirements forall other control rods, the one-rod-out interlock(LCO 3.9.2), control rod position indication (LCO 3.9.4),and scram functions (LCO 3.3.1.1, "Reactor Protection System(RPS) Instrumentation," and LCO 3.9.5, "Control RodOPERABILITY-Refueling"), or the added administrativecontrols in Item b.2 and Item c.2 of this Special OperationsLCO, provide mitigation of potential reactivity excursions.

ACTIONS A Note has been provided to modify the ACTIONS related to asingle control rod withdrawal while in MODE 4. Section 1.3,Completion Times, specifies that once a Condition has beenentered, subsequent divisions, subsystems, components, orvariables expressed in the Condition discovered to beinoperable or not within limits, will not result in separateentry into the Condition. Section 1.3 also specifies thatRequired Actions of the Condition continue to apply for eachadditional failure, with Completion Times based on initialentry into the Condition. However, the Required Actions foreach requirement of the LCO not met provide appropriatecompensatory measures for separate requirements that are notmet. As such, a Note has been provided that allows separateCondition entry for each requirement of the LCO.

(continued)


Single CRD Removal-.RefuelingB 3.10.5

BASES (continued)

'APPLICABLE With the reactor mode switch in the refuel position, theSAFETY ANALYSES analyses for control rod withdrawal during refueling are

applicable and, provided the assumptions of these analysesare satisfied, these analyses will bound the consequences ofaccidents. Explicit safety analyses in the UFSAR (Refs. 1and 2) demonstrate that proper operation of the refuelinginterlocks and adequate SDM will preclude unacceptablereactivity excursions.

Refueling interlocks restrict the movement of control rodsand the operation of the refueling equipment to reinforceoperational procedures that prevent the reactor frombecoming critical. These interlocks prevent the withdrawalof more than one control rod. Under these conditions, sinceonly one control rod can be withdrawn, the core will alwaysbe shut down even with the highest worth control rodwithdrawn if adequate SDM exists. By requiring all othercontrol rods to be inserted and a control rod withdrawalblock initiated, the function of the inoperable one-rod-outinterlock (LCO 3.9.2) is adequately maintained. ThisSpecial Operations LCO requirement to suspend all COREALTERATIONS adequately compensates for the inoperable allrods in permissive for the refueling equipment interlocks(LCO 3.9.1).

The control rod scram function provides backup protection tonormal refueling procedures and the refueling interlocks,which prevent inadvertent criticalities during refueling.Since the scram function and refueling interlocks may besuspended, alternate backup protection required by thisSpecial Operations LCO is obtained by ensuring that a fiveby five array of control rods, centered on the withdrawncontrol rod, are inserted and are incapable of beingwithdrawn, and all other control rods are inserted andincapable of being withdrawn (by insertion of a control rodblock).


(continued)

PBAPS UNIT 2 B 3.1]0-20 Revision No. 0

Single CRD Removal--RefuelingB 3.10.5

BASES (continued)

LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. Operation in MODE 5 with any ofthe following LCOs, LCO 3.3.1.1, "Reactor Protection System(RPS) Instrumentation," LCO 3.3.8.2, "Reactor ProtectionSystem (RPS) Electric Power Monitoring," LCO 3.9.1,LCO 3.9.2, LCO 3.9.4, or LCO 3.9.5 not met, can be performedin accordance with the Required Actions of these LCOswithout meeting this Special Operations LCO or its ACTIONS.However, if a single CRD removal from a core cell containingone or more fuel assemblies is desired in MODE 5, controlsconsistent with those required by LCO 3.3.1.1, LCO 3.3.8.2,LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 must beimplemented, and this Special Operations LCO applied.

By requiring all other control rods to be inserted and acontrol rod withdrawal block initiated, the function of theinoperable one-rod-out interlock (LCO 3.9.2) is adequatelymaintained. This Special Operations LCO requirement tosuspend all CORE ALTERATIONS adequately compensates for theinoperable all rods in permissive for the refuelingequipment interlocks (LCO 3.9.1). Ensuring that the five byfive array of control rods, centered on the withdrawncontrol rod, are inserted and incapable of withdrawaladequately satisfies the backup protection that LCO 3.3.1.1and LCO 3.9.2 would have otherwise provided. Also, oncethese requirements (Items a, b, and c) are completed, theSDM requirement to account for both the withdrawnuntrippable (inoperable) control rod and the highest worthcontrol rod may be changed to allow the withdrawnuntrippable (inoperable) control rod to be the singlehighest worth control rod.

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. Theallowance to comply with this Special Operations LCO in lieuof the ACTIONS of LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1,LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 is appropriatelycontrolled with the additional administrative controlsrequired by this Special Operations LCO, which reduce thepotential for reactivity excursions.

(continued)


Single CRD Removal-RefuelingB 3.10.5


B 3.10.5 Single Control Rod Drive (CRD) Removal-Refueling

BASES

BACKGROUND The purpose of this MODE 5 Special Operations LCO is topermit the removal of a single CRD during refuelingoperations by imposing certain administrative controls.Refueling interlocks restrict the movement of control rodsand the operation of the refueling equipment to reinforceoperational procedures that prevent the reactor frombecoming critical during refueling operations. Duringrefueling operations, no more than one control rod ispermitted to be withdrawn from a core cell containing one ormore fuel assemblies. The refueling interlocks use the"full-in" position indicators to determine the position ofall control rods. If the "full-in" position signal isnotpresent for every control rod, then the all rods inpermissive for the refueling equipment interlocks is notpresent and fuel loading is prevented. Also, the refuelposition one-rod-out interlock will not allow the withdrawalof a second control rod.

The control rod scram function provides backup protection inthe event normal refueling procedures, and the refuelinginterlocks described above fail to prevent inadvertentcriticalities during refueling. The requirement for thisfunction to be OPERABLE precludes the possibility ofremoving the CRD once a control rod is withdrawn from a corecell containing one or more fuel assemblies. This SpecialOperations LCO provides controls sufficient to ensure thepossibility of an inadvertent criticality is precluded,while allowing a single CRD to be removed from a core cellcontaining one or more fuel assemblies. The removal of theCRD involves disconnecting the position indication probe,which causes noncompliance with LCO 3.9.4, "Control RodPosition Indication," and, therefore, LCO 3.9.1, "RefuelingEquipment Interlocks," and LCO 3.9.2, "Refueling PositionOne-Rod-Out Interlock." The CRD removal also requiresisolation of the CRD from the CRD Hydraulic System, therebycausing inoperability of the control rod (LCO 3.9.5,"Control Rod OPERABILITY-Refueling").

(continued)



BASES (continued)

ACTIONS A.I. A.2.1, and A.2.2

If one or more of the requirements of this- SpecialOperations LCO are not met, the immediate implementation ofthese Required Actions restores operation consistent withthe normal requirements for failure to meet LCO 3.3.1.1,LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 (i.e., allcontrol rods inserted) or with the allowances of thisSpecial Operations LCO. The Completion Times for RequiredAction A.1, Required Action A.2.1, and Required Action A.2.2are intended to require that these Required Actions beimplemented in a very short time and carried through in anexpeditious manner to either initiate action to restore theCRD and insert its control rod, or initiate action torestore compliance with this Special Operations LCO.Actions must continue until either Required Action A.2.1 orRequired Action A.2.2 is satisfied.

SURVEILLANCE SR 3.10.5.1. SR 3.10.5.2. SR 3.10.5.3. SR 3.10.5.4,REQUIREMENTS and SR 3.10.5.5

Verification that all the control rods, other than thecontrol rod withdrawn for the removal of the associated CRD,are fully inserted is required to ensure the SDM is withinlimits. Verification that the local five by five array ofcontrol rods, other than the control rod withdrawn forremoval of the associated CRD, is inserted and disarmed,while the scram function for the withdrawn rod is notavailable, is required to ensure that the possibility ofcriticality remains precluded. Verification that a controlrod withdrawal block has been inserted ensures that no othercontrol rods can be inadvertently withdrawn under conditionswhen position indication instrumentation is inoperable forthe withdrawn control rod. The Surveillance for LCO 3.1.1,which is made applicable by this Special Operations LCO, isrequired in order to establish that this Special OperationsLCO is being met. Verification that no other COREALTERATIONS are being made is required to ensure theassumptions of the safety analysis are satisfied.

Periodic verification of the administrative controlsestablished by this Special Operations LCO is prudent topreclude the possibility of an inadvertent criticality. The24 hour Frequency is acceptable, given the administrativecontrols on control rod removal and hardwire interlock toblock an additional control rod withdrawal.

(continued)



BASES (continued)

REFERENCES 1.

2.

UFSAR, Section 7.6.4.

UFSAR, Section 14.5.3.3.


Multiple Control Rod Withdrawal -RefuelingB 3.10.6


B 3.10.6 Multiple Control Rod Withdrawal--Refueling

BASES

BACKGROUND The purpose of this MODE 5 Special Operations LCO is topermit multiple control rod withdrawal during refueling byimposing certain administrative controls.

Refueling interlocks restrict the movement of control rodsand the operation of the refueling equipment to reinforceoperational procedures that prevent the reactor frombecoming critical during refueling operations. Duringrefueling operations, no more than one control rod ispermitted to be withdrawn from a core cell containing one ormore fuel assemblies. When all four fuel assemblies areremoved from a cell, the control rod may be withdrawn withno restrictions. Any number of control rods may bewithdrawn and removed from the reactor vessel if their cellscontain no fuel.

The refueling interlocks use the "full-in" positionindicators to determine the position of all control rods.If the "full-in" position signal is not present for everycontrol rod, then the all rods in permissive for therefueling equipment interlocks is not present and fuelloading is prevented. Also, *the refuel position one-rod-outinterlock will not allow the withdrawal of a second controlrod.

To allow more than one control rod to be withdrawn duringrefueling, these interlocks must be defeated. This SpecialOperations LCO establishes the necessary administrativecontrols to allow bypassing the "full-in" positionindicators.

APPLICABLE Explicit safety analyses in the UFSAR (Refs. 1, 2, and 3)SAFETY ANALYSES demonstrate that the functioning of the refueling interlocks

and adequate SDM will prevent unacceptable reactivityexcursions during refueling. To allow multiple control rodwithdrawals, control rod removals, associated control roddrive (CRD) removal, or any combination of these, the "fullin" position indication is allowed to be bypassed for eachwithdrawn control rod if all fuel has been removed from thecell. With no fuel assemblies in the core cell, the

(continued)


Multiple Control Rod Withdrawal-RefuelingB 3.10.6

BASES

APPLICABLE associated control rod has no reactivity control functionSAFETY ANALYSES and is not required to remain inserted. Prior to reloading

(continued) fuel into the cell, however, the associated control rod mustbe inserted to ensure that an inadvertent criticality doesnot occur, as evaluated in the Reference 3 analysis.


LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. Operation in MODE 5 with eitherLCO 3.9.3, "Control Rod Position," LCO 3.9.4, "Control RodPosition Indication," or LCO 3.9.5, "Control RodOPERABILITY-Refueling," not met, can be performed inaccordance with the Required Actions of these LCOs withoutmeeting this Special Operations LCO or its ACTIONS. Ifmultiple control rod withdrawal or removal, or CRD removalis desired, all four fuel assemblies are required to beremoved from the associated cells. Prior to entering thisLCO, any fuel remaining in a cell whose CRD was previouslyremoved under the provisions of another LCO must be removed."Withdrawal," in this application, includes the actualwithdrawal of the control rod, as well as maintaining thecontrol rod in a position other than the full-in position,and reinserting the control rod.

When fuel is loaded into the core with multiple control rodswithdrawn, special modified quadrant spiral reload sequencesare used to ensure that reactivity additions are minimized.Spiral reloading encompasses reloading a cell (four fuellocations immediately adjacent to a control rod) on the edgeof a continuous fueled region (the cell can be loaded in anysequence). Otherwise, all control rods must be fullyinserted before loading fuel.

(continued)


Multiple Control Rod Withdrawal -RefuelingB 3.10.6

BASES (continued)

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. Theexceptions from other LCO requirements (e.g., the ACTIONS ofLCO 3.9.3, LCO 3.9.4, or LCO 3.9.5) allowed by this SpecialOperations LCO are appropriately controlled by requiring allfuel to be removed from cells whose "full-in" indicators areallowed to be bypassed.

ACTIONS A.I. A.2. A.3.1, and A.3.2

If one or more of the requirements of this SpecialOperations LCO are not met, the immediate implementation ofthese Required Actions restores operation consistent withthe normal requirements for refueling (i.e., all controlrods inserted in core cells containing one or more fuelassemblies) or with the exceptions granted by this SpecialOperations LCO. The Completion Times for RequiredAction A.1, Required Action A.2, Required Action A.3.1, andRequired Action A.3.2 are intended to require that theseRequired Actions be implemented in a very short time andcarried through in an expeditious manner to either initiateaction to restore the affected CRDs and insert their controlrods, or initiate action to restore compliance with thisSpecial Operations LCO.

SURVEILLANCE SR 3.10.6.1, SR 3.10.6.2. and SR 3.10.6.3REQUIREMENTS

Periodic verification of the administrative controlsestablished by this Special Operations LCO is prudent topreclude the possibility of an inadvertent criticality. The24 hour Frequency is acceptable, given the administrativecontrols on fuel assembly and control rod removal, and takesinto account other indications of control rod statusavailable in the control room.





Control Rod Testing-OperatingB 3.10.7


B 3.10.7 Control Rod Testing-Operating

BASES

BACKGROUND The purpose of this Special Operations LCO is to permitcontrol rod testing, while in MODES I and 2, by imposingcertain administrative controls. Control rod patternsduring startup conditions are controlled by the operator andthe rod worth minimizer (RWM) (LCO 3.3.2.1, "Control RodBlock Instrumentation'), such that only the specifiedcontrol rod sequences and relative positions required byLCO 3.1.6, "Rod Pattern Control," are allowed over theoperating range from all control rods inserted to the lowpower setpoint (LPSP) of the RWM. The sequences effectivelylimit the potential amount and rate of reactivity increasethat could occur during a control rod drop accident (CRDA).During these conditions, control rod testing is sometimesrequired that may result in control rod patterns not incompliance with the prescribed sequences of LCO 3.1.6.These tests include SDM demonstrations, control rod scramtime testing, control rod friction testing, and testingperformed during the Startup Test Program. This SpecialOperations LCO provides the necessary exemption to therequirements of LCO 3.1.6 and provides additionaladministrative controls to allow the deviations in suchtests from the prescribed sequences in LCO 3.1.6.

APPLICABLE The analytical methods and assumptions used in evaluatingSAFETY ANALYSES the CRDA are summarized in References 1 and 2. CRDA

analyses assume the reactor operator follows prescribedwithdrawal sequences. These sequences define the potentialinitial conditions for the CRDA analyses. The RWM providesbackup to operator control of the withdrawal sequences toensure the initial conditions of the CRDA analyses are notviolated. For special sequences developed for control rodtesting, the initial control rod patterns assumed in thesafety analysis of References I and 2 may not be preserved.Therefore special CRDA analyses are required to demonstratethat these special sequences will not result in unacceptableconsequences, should a CRDA occur during the testing. Theseanalyses, performed in accordance with an NRC approvedmethodology, are dependent on the specific test beingperformed.

(continued)



BASES

APPLICABILITY(continued)

Special Operations LCO 3.10.3, "Single Control RodWithdrawal-Hot Shutdown," or Special Operations LCO 3.10.4,"Single Control Rod Withdrawal-Cold Shutdown," whichprovide adequate controls to ensure that the assumptions ofthe safety analyses of Reference I and 2 are satisfied.During these Special Operations and while in MODE 5, theone-rod-out interlock (LCO 3.9.2, "Refuel PositionOne-Rod-Out Interlock,") and scram functions (LCO 3.3.1.1,"Reactor Protection System (RPS) Instrumentation," andLCO 3.9.5, "Control Rod OPERABILITY-Refueling"), or theadded administrative controls prescribed in the applicableSpecial Operations LCOs, provide mitigation of potentialreactivity excursions.

ACTIONS A. 1

With the requirements of the LCO not met (e.g., the controlrod pattern is not in compliance with the special testsequence, the sequence is improperly loaded in the RWM) thetesting is required to be immediately suspended. Uponsuspension of the special test, the provisions of LCO 3.1.6are no longer excepted, and appropriate actions are to betaken to restore the control rod sequence to the prescribedsequence of LCO 3.1.6, or to shut down the reactor, ifrequired by LCO 3.1.6.


SR 3.10.7.1

With the special test sequence not programmed into the RWM,a second licensed operator or other qualified member of thetechnical staff (i.e., personnel trained in accordance withan approved training program for this test) is required toverify conformance with the approved sequence for the test.This verification must be performed during control rodmovement to prevent deviations from the specified sequence.A Note is added to indicate that this Surveillance does notneed to be met if SR 3.10.7.2 is satisfied.

(continued)



BASES


(continued) When the RWM provides conformance to the special testsequence, the test sequence must be verified to be correctlyloaded into the RWM prior to control rod movement. ThisSurveillance demonstrates compliance with SR 3.3.2.1.8,thereby demonstrating that the RWM is OPERABLE. A Note hasbeen added to indicate that this Surveillance does not needto be met if SR 3.10.7.1 is satisfied.

REFERENCES 1. NEDE-24011-P-A-US, General Electric StandardApplication for Reactor Fuel, Supplement for UnitedStates, February 1991.

2. Letter from T. Pickens (BWROG) to G.C. Lainas (NRC)"Amendment 17 to General Electric Licensing TopicalReport NEDE-24011-P-A," August 15, 1986.



BASES

APPLICABLE As described in LCO 3.0.7, compliance with SpecialSAFETY ANALYSES Operations LCOs is optional, and therefore, no criteria of

(continued) the NRC Policy Statement apply. Special Operations LCOsprovide flexibility to perform certain operations byappropriately modifying requirements of other LCOs. Adiscussion of the criteria satisfied for the other LCOs isprovided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. Control rod testing may beperformed in compliance with the prescribed sequences ofLCO 3.1.6, and during these tests, no exceptions to therequirements of LCO 3.1.6 are necessary. For testingperformed with a sequence not in compliance with LCO 3.1.6,the requirements of LCO 3.1.6 may be suspended, providedadditional administrative controls are placed on the test toensure that the assumptions of the special safety analysisfor the test sequence are satisfied. Assurances that thetest sequence is followed can be provided by eitherprogramming the test sequence into the RWM, with conformanceverified as specified in SR 3.3.2.1.8 and allowing the RWMto monitor control rod withdrawal and provide appropriatecontrol rod blocks if necessary, or by verifying conformanceto the approved test sequence by a second licensed operatoror other qualified member of the technical staff. Thesecontrols are consistent with those normally applied tooperation in the startup range as defined in the SRs andACTIONS of LCO 3.3.2.1, "Control Rod Block Instrumentation."

APPLICABILITY Control rod testing, while in MODES I and 2, with THERMALPOWER greater than 10% RTP, is adequately controlled by theexisting LCOs on power distribution limits and control rodblock instrumentation. Control rod movement during theseconditions is not restricted to prescribed sequences and canbe performed within the constraints of LCO 3.2.1, "AVERAGEPLANAR LINEAR HEAT GENERATION RATE (APLHGR)," LCO 3.2.2,"MINIMUM CRITICAL POWER RATIO (MCPR)," LCO 3.2.3, "LINEARHEAT GENERATION RATE (LHGR)," and LCO 3.3.2.1. With THERMALPOWER less than or equal to 10%. RTP, the provisions of thisSpecial Operations LCO are necessary to perform specialtests that are not in conformance with the prescribedsequences of LCO 3.1.6. While in MODES 3 and 4, control rodwithdrawal is only allowed if performed in accordance with

(continued)


SDM Test - RefuelingB 3.10.8


B 3.10.8 SHUTDOWN MARGIN (SDM) Test-Refueling

BASES

BACKGROUND The purpose of this MODE 5 Special Operations LCO is topermit SDM testing to be performed for those plantconfigurations in which the reactor pressure vessel (RPV)head is either not in place or the head bolts are not fullytensioned.

LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," requires that adequateSDM be demonstrated following fuel movements or control rodreplacement within the RPV. The demonstration must beperformed prior to or within 4 hours after criticality isreached. This SDM test may be performed prior to or duringthe first startup following the refueling. Performing theSDM test prior to startup requires the test to be performedwhile in MODE 5, with the vessel head bolts less than fullytensioned (and possibly with the vessel head removed).While in MODE 5, the reactor mode switch is required to bein the shutdown or refuel position, where the applicablecontrol rod blocks ensure that the reactor will not becomecritical. The SDM test requires the reactor mode switch tobe in the startup/hot standby position, since more than onecontrol rod will be withdrawn for the purpose ofdemonstrating adequate SDM. This Special Operations LCOprovides the appropriate additional controls to allowwithdrawing more than one control rod from a core cellcontaining one or more fuel assemblies when the reactorvessel head bolts are less than fully tensioned.


Prevention and mitigation of unacceptable reactivityexcursions during control rod withdrawal, with the reactormode switch in the startup/hot standby position while inMODE 5, is provided by the wide range neutron monitor (WRNM)period-short scram (LCO 3.3.1.1, "Reactor Protection System(RPS) Instrumentation"), and control rod blockinstrumentation (LCO 3.3.2.1, "Control Rod BlockInstrumentation"). The limiting reactivity excursion duringstartup conditions while in MODE 5 is the control rod dropaccident (CRDA).

(continued)


SDM Test- RefuelingB 3.10.8

BASES


(continued)

CRDA analyses assume that the reactor operator followsprescribed withdrawal sequences. For SDM tests performedwithin these defined sequences, the analyses of References Iand 2 are applicable. However, for some sequences developedfor the SDM testing, the control rod patterns assumed in thesafety analyses of References 1 and 2 may not be met.Therefore, special CRDA analyses, performed in accordancewith an NRC approved methodology, are required todemonstrate the SDM test sequence will not result inunacceptable consequences should a CRDA occur during thetesting. For the purpose of this test, the protectionprovided by the normally required MODE 5 applicable LCOs, inaddition to the requirements of this LCO, will maintainnormal test operations as well as postulated accidentswithin the bounds of the appropriate safety analyses(Refs. I and 2). In addition to the added requirements forthe RWM, WRNM, APRM, and control rod coupling, the notch outmode is specified for out of sequence withdrawals.Requiring the notch out mode limits withdrawal steps to asingle notch, which limits inserted reactivity, and allowsadequate monitoring of changes in neutron flux, which mayoccur during the test.


LCO As described in LCO 3.0.7, compliance with this SpecialOperations LCO is optional. SDM tests may be performedwhile in MODE 2, in accordance with Table 1.1-1, withoutmeeting this Special Operations LCO or its ACTIONS. For SDMtests performed while in MODE 5, additional requirementsmust be met to ensure that adequate protection againstpotential reactivity excursions is available. To provideadditional scram protection beyond the normally requiredWRNMs, the APRMs are also required to be OPERABLE (LCO3.3.1.1, Functions 2a, 2.d and 2e) as though the reactorwere in MODE 2. Because multiple control rods will bewithdrawn and the reactor will potentially become critical,the approved control rod withdrawal sequence must beenforced by the RWM (LCO 3.3.2.1, Function 2, MODE 2), ormust be verified by a

(continued)


SDM Test-RefuelingB 3.10.8

BASES

LCO(continued)

second licensed operator or other qualified member of thetechnical staff. To provide additional protection againstan inadvertent criticality, control rod withdrawals that donot conform to the banked position withdrawal sequencespecified in LCO 3.1.6, "Rod Pattern Control," (i.e., out ofsequence control rod withdrawals) must be made in theindividual notched withdrawal mode to minimize the potentialreactivity insertion associated with each movement.Coupling integrity of withdrawn control rods is required tominimize the probability of a CRDA and ensure properfunctioning of the withdrawn control rods, if they arerequired to scram. Because the reactor vessel head may beremoved during these tests, no other CORE ALTERATIONS may bein progress. Furthermore, since the control rod scramfunction with the RCS at atmospheric pressure relies solelyon the CRD accumulator, it is essential that the CRDcharging water header remain pressurized. This SpecialOperations LCO then allows changing the Table 1.1-1 reactormode switch position requirements to include the startup/hotstandby position, such that the SDM tests may be performedwhile in MODE 5.

APPLICABILITY These SDM test Special Operations requirements are onlyapplicable if the SDM tests are to be performed while inMODE 5 with the reactor vessel head removed or the headbolts not fully tensioned. Additional requirements duringthese tests to enforce control rod withdrawal sequences andrestrict other CORE ALTERATIONS provide protection againstpotential reactivity excursions. Operations in all otherMODES are unaffected by this LCO.

ACTIONS A.1 and A.2

With one or more control rods discovered uncoupled duringthis Special Operation, a controlled insertion of eachuncoupled control rod is required; either to attemptrecoupling, or to preclude a control rod drop. Thiscontrolled insertion is preferred since, if the control rodfails to follow the drive as it is withdrawn (i.e., is"stuck" in an inserted position), placing the reactor modeswitch in the shutdown position per Required Action B.1could cause substantial secondary damage. If recoupling isnot accomplished, operation may continue, provided thecontrol rods are fully inserted within 3 hours and disarmed(electrically or hydraulically) within 4 hours. Inserting a

(continued)


SDM Test-RefuelingB 3.10.8

BASES


control rod ensures the shutdown and scram capabilities arenot adversely affected. The control rod is disarmed toprevent inadvertent withdrawal during subsequent operations.The control rods can be hydraulically disarmed by closingthe drive water and exhaust water isolation valves.Electrically, the control rods can be disarmed bydisconnecting power from all four directional control valvesolenoids. Required Action A.1 is modified by a Note thatallows the RWM to be bypassed if required to allow insertionof the inoperable control rods and continued operation.LCO 3.3.2.1, "Control Rod Block Instrumentation," ACTIONSprovide additional requirements when the RWM is bypassed toensure compliance with the CRDA analysis.

The allowed Completion Times are reasonable, considering thesmall number of allowed inoperable control rods, and providetime to insert and disarm the control rods in an orderlymanner and without challenging plant systems.

Condition A is modified by a Note allowing separateCondition entry for each uncoupled control rod. This isacceptable since the Required Actions for this Conditionprovide appropriate compensatory actions for each uncoupledcontrol rod. Complying with the Required Actions may allowfor continued operation. Subsequent uncoupled control rodsare governed by subsequent entry into the Condition andapplication of the Required Actions.

B.1

With one or more of the requirements of this LCO not met forreasons other than an uncoupled control rod, the testingshould be immediately stopped by placing the reactor modeswitch in the shutdown or refuel position. This results ina condition that is consistent with the requirements forMODE 5 where the provisions of this Special Operations LCOare no longer required.

(continued)


SDM Test - RefuelingB 3.10.8

BASES


(continued)

SR 3.10.8.6

CRD charging water header pressure verification is performedto ensure the motive force is available to scram the controlrods in the event of a scram signal. Since the reactor isdepressurized in MODE 5, there is insufficient reactorpressure to scram the control rods. Verification ofcharging water header pressure ensures that if a scram wererequired, capability for rapid control rod insertion wouldexist. The minimum pressure of 940 psig is well below theexpected pressure of approximately 1450 psig while stillensuring sufficient pressure for rapid control rodinsertion. The 7 day Frequency has been shown to beacceptable through operating experience and takes intoaccount indications available in the control room.

I

REFERENCES 1. NEDE-24011-P-A-US, General Electric StandardApplication for Reactor Fuel, Supplement for UnitedStates, February 1991.

2. Letter from T. Pickens (BWROG) to G.C. Lainas, NRC,"Amendment 17 to General Electric Licensing TopicalReport NEDE-24011-P-A," August 15, 1986.


SDM Test -RefuelingB 3.10.8

BASES (continued)

SURVEILLANCE SR 3.10.8.1. SR 3.10.8.2. and SR 3.10.8.3REQUIREMENTS

LCO 3.3.1.1, Functions 2a, 2.d and 2e, made applicable inthis Special Operations LCO, are required to have theirSurveillances met to establish that this Special OperationsLCO is being met. However, the control rod withdrawalsequences during the SOM tests may be enforced by the RWM(LCO 3.3.2.1, Function 2, MODE 2 requirements) or by asecond licensed operator or other qualified member of thetechnical staff. As noted, either the applicable SRs forthe RWM (LCO 3.3.2.1) must be satisfied according to theapplicable Frequencies (SR 3.10.8.2), or the proper movementof control rods must be verified (SR 3.10.8.3). This latterverification (i.e., SR 3.10.8.3) must be performed duringcontrol rod movement to prevent deviations from thespecified sequence. These surveillances provide adequateassurance that the specified test sequence is beingfollowed.

SR 3.10.8.4

Periodic verification of the administrative controlsestablished by this LCO will ensure that the reactor isoperated within the bounds of the safety analysis. The12 hour Frequency is intended to provide appropriateassurance that each operating shift is aware of and verifiescompliance with these Special Operations LCO requirements.

SR 3.10.8.5

Coupling verification is performed to ensure the control rodis connected to the control rod drive mechanism and willperform its intended function when necessary. The

verification is required to be performed any time a controlrod is withdrawn to the "full out" notch position, or priorto declaring the control rod OPERABLE after work on thecontrol rod or CRD System that could affect coupling. ThisFrequency is acceptable, considering the low probabilitythat a control rod will become uncoupled when it is notbeing moved as well as operating experience related touncoupling events.

(continued)


Documents

Pbaps u2 Ts Bases